What problem does it solve? RAG pipelines and vector databases can leak documents across tenants when chunking, indexing, or retrieval ignores ACL boundaries. This Skill provides a controlled methodology to verify that document ingestion, embedding, retrieval, and deletion respect tenant isolation before real data is at risk. ## Core Features & Use Cases - Cross-Tenant Isolation Testing: Uploads distinct canary documents to separate tenants and checks whether retrieval results, source metadata, or citations leak across boundaries. - Deletion and ACL Residual Checks: Verifies that deleted or permission-revoked documents no longer appear in retrieval results, using backend records and retrieval evidence as oracles. - Evidence-Gated Workflow: Enforces a baseline → single-variable probe → post-baseline → oracle → evidence loop, treating WAF blocks, timeouts, and model hallucinations as inconclusive rather than findings. - Use Case: A security researcher authorized to test a knowledge-base chatbot uploads canary documents under two test tenants, then confirms Tenant B never receives Tenant A's content in similarity search results. ## Quick Start Ask the agent to run the RAG vector isolation assessment against my two authorized test tenants and report any cross-tenant retrieval leaks with evidence.
