How would you enforce tenant and document access in a RAG system?

Security testing covers cross-tenant semantic similarity, guessed document IDs, malicious query rewrites, inherited ACL changes, stale group membership, and failure of the permission dependency. Logs prove which filter and authorization context constrained a request without recording more identity data than needed. Highly sensitive corpora may use physical index separation in addition to logical filters, based on threat model and operational cost. Retrieved content remains untrusted input, so access permission does not grant it authority to change tools or application policy.