How do you implement RAG security and access control for multi-tenant systems?

Multi-tenant RAG security requires document-level access control throughout the pipeline. Architecture: tag every chunk with tenant ID, user permissions, and access groups during indexing. At retrieval time, apply metadata filters before vector search to ensure users only access authorized content. Implementation: use vector database namespace isolation (separate collections per tenant) for strict isolation, or metadata filtering (tenantid filter in query) for shared infrastructure. Row-level security: in pgvector/Supabase, implement RLS policies that filter by the authenticated user's tenant ID. Document-level permissions: store an ACL (access control list) with each chunk containing allowed user IDs, group IDs, or role names, and filter during retrieval. Encryption: encrypt embeddings at rest, use TLS for all communication, implement key-per-tenant encryption for regulated industries. Audit logging: log every retrieval with user ID, query, retrieved chunk IDs, and timestamp. Prevent prompt injection: sanitize retrieved content before including in LLM context, use delimiters to separate context from instructions. Data residency: for regulated industries, implement geographic routing to keep data in approved regions. Regular security testing should verify tenant isolation with automated tests attempting cross-tenant data access.