Quick answer

RAG customer isolation prevents documents that a user cannot access from reaching retrieval results and model context. Asking the model to keep information secret is insufficient. Retrieval must enforce permissions and the same boundary must extend to caches and source links. When permissions are removed the delay before access ends must be measured.

This guide focuses on acceptance testing for enterprise search and assistants serving multiple customers. It complements the broader RAG and vector database security guide.

Inspect the pipeline before the final answer

An answer can look properly filtered even though an unauthorized passage has already reached a model provider or a tracing system. Inspect retrieved chunks and model context separately from the final answer and the linked source document.

Microsoft's RAG security guidance recommends access control during retrieval and treating retrieved content as untrusted input. Relevance and permission are different properties. A highly relevant document may still be unavailable to the current user.

Chunks need an explicit relationship to their source document and permissions. Missing permission metadata should not silently mean public access. A genuinely public collection should have an explicit policy of its own.

Build a synthetic test environment

Create two customers named A and B. Give each a standard user. Add an administrator for A and a user whose access will later be removed. Place unpredictable synthetic markers in documents assigned to particular roles. Avoid real confidential data.

A marker appearing in the wrong customer's answer demonstrates a leak. Its absence does not prove isolation. Inspect retrieval evidence to determine whether the passage entered model context without appearing in the response.

Derive customer identity from authenticated server context rather than a customer field supplied by the client. The OWASP multitenant security guide addresses boundaries across storage and caching layers. Include these layers in the assessment rather than evaluating only vector queries.

Twelve proposed acceptance cases

This original worksheet is a practical test proposal. It is not a certification scheme. Record the exact identity and document version used in each case.

No Test Expected result Observation point
1 A requests its own authorized document Relevant authorized content returned Retrieval and answer
2 B requests A's document with the same wording A's content excluded Retrieval trace
3 User asks for an inaccessible document title No confidential title or summary disclosed Answer and source list
4 Client changes the customer field Verified server identity controls access Authorization record
5 Another customer warms the retrieval cache Earlier customer's results not reused Cache key and output
6 Another user requests a cached answer Permission context preserved Cache policy version
7 Document arrives without permission metadata Quarantine or denied access Ingestion outcome
8 Group membership is removed Access ends within the defined policy Revocation timeline
9 Document moves to another customer or folder Old ownership grants no access Index and source checks
10 User opens a source link from an old answer Current permission checked File access record
11 Retrieval service fails No silent switch to broader access Error and fallback trace
12 Output filter hides an unauthorized passage Test still fails if it reached model context Model request summary

Download the RAG isolation worksheet. The authorized control case matters. Blocking every request does not satisfy functional acceptance.

Measure permission revocation as a timeline

Record the time permission was removed at the source. Then record when the policy copy updated. Finally record the last accepted unauthorized request and the first consistent denial. Include the polling interval. A test performed every thirty seconds cannot claim millisecond precision.

These observations separate different delays. The indexer may be slow while a session retains old group membership. A cached answer may bypass both. A single synchronization metric can hide those differences.

The acceptable interval is a business and security decision. Five minutes could be a chosen limit for a synthetic exercise but is not a universal standard. Sensitive data may require a much shorter limit or a current policy check on every request. Define what revocation means for previous conversation history. Retracting a copy already downloaded by an authorized user is a separate problem.

Product capabilities vary by version. Some permission integrations are preview features with particular synchronization behavior. Check the implemented feature rather than assuming that every source update is instantly reflected. Azure AI Search document access models provide a concrete example of these implementation differences.

Fictional case: a quotation survives in cache

An assistant answers a pricing question for customer A. The answer cache uses only the question text as its key. Customer B asks the same question and receives A's discount. The vector query might be perfectly filtered because the cache bypassed it altogether.

Validate the correction in two stages. First show that the cache respects the required authorization context. Then change the same user's permissions and repeat the request. Adding a customer identifier alone does not address every role change or document revocation. Shared caches require an explicit argument that the sharing boundary is safe.

Make the result auditable

Report identity pairs and data classes tested. State whether retrieval traces were available. Collect the minimum evidence necessary to explain the result without copying confidential prompts into a general report.

Assign an owner to each failing case and retain the test corpus for retesting. A new data source should trigger a fresh review of permission propagation. The deliverable is a repeatable acceptance process rather than a permanent safe label.

Frequently asked questions

Is a separate vector database required for each customer?

No. Physical and logical separation are design choices with different costs and risks. Both still require identity and source access testing.

Is putting the customer name in the prompt enough?

No. Prompt text is not an authorization mechanism. Server policies must control retrieval and file access.

Does a clean answer prove the test passed?

No. The test must also establish whether unauthorized content reached context or logs.

Must deleted documents disappear from old conversations?

Define that behavior through retention and access policies. Blocking the current source does not automatically remove earlier conversation copies.

Scope the work with DSET

For DSET assessment scoping start with data sources and the role model. Identify where permissions are authoritative. Synthetic documents can demonstrate the boundaries without sharing client records. Include MCP acceptance testing when the assistant also operates tools.

Editorial note: The scenarios and timeline are original proposals for this guide. They are not client findings or measured success claims. Sources were checked on 11 October 2026.