agentsop-multi-tenant-rag

What problem does it solve?

This Skill prevents cross-tenant data leakage in multi-tenant retrieval-augmented generation (RAG) systems by enforcing tenant isolation at the vector store query boundary, before retrieved content reaches the LLM context.

Core Features & Use Cases

• Tenant Isolation SOP: Provides a security-first operating model for designing, reviewing, and debugging retrieval pipelines where a shared vector store serves multiple tenants.
• Query-Time Filter Enforcement: Encodes the non-negotiable rule to filter at the vector store query (and never after retrieval or after rerank), including per-vendor filter syntax and framework adapters.
• Production-Ready Verification: Includes cross-tenant property tests, runtime assertions, audit logging guidance, and defense-in-depth patterns (namespace/tenant primitives plus filter belt-and-braces).

Quick Start

Ask your coding agent to apply the agentsop-multi-tenant-rag isolation SOP to every vector store query in your multi-tenant RAG pipeline and generate the required cross-tenant tests plus runtime assertions.