You're leaking data if your agent memory uses post-filter tenant scoping
Critical-Home9648 · reddit · 2026-09-16
A detailed post-mortem on multi-tenant agent memory isolation: a shared index plus a system-prompt rule "only use customer X's memories" fails because retrieval leaks data before the model sees anything.
Three leak paths
- Post-filtered vector search scans the whole index, drops out-of-scope rows afterward — hurting recall for small tenants and touching other tenants' vectors. Fix: partitioned storage with mandatory partition keys on writes.
- Graph stores ignore tenant boundaries: scoping the seed node isn't enough; a two-hop traversal through a shared vendor entity can walk into another tenant's subgraph. Fix: scope the subgraph, duplicate entities per tenant.
- Cache keys missing the tenant: query-text + embedding-hash keys let tenant A's warm result serve tenant B verbatim — same bug applies to embedding caches, dedupe tables, and rerank caches.
Model: scope attaches at write time (missing scope = failed write, no default bucket); hierarchy is user→customer→client as a materialized path; retrieval requires an explicit scope path so out-of-scope data never enters the process — making prompt injection irrelevant. Entity resolution must also be scoped, with low-confidence matches routed to review queues: an unmerged duplicate is an annoyance, a wrong merge is an incident. Deletion is the real test — tombstoned vectors aren't deleted; dropping a partition is.
Testing: use two tenants with near-identical records (same names, closest embeddings) and verify zero cross-tenant rows at every k, then repeat with one tenant 1000x larger to expose post-filter recall drops.
More from coding & agent
- Reverse engineering in 2026: hand the agent a goal, walk the dog, come back to a perfect IDB — dyn___ · 2026-09-16
- Jev model claims 40-400x cheaper than Gemini; dev backtest finds it faster and more consistent — FrankFelixAI · 2026-09-16
- Vibe coding feels like scrubbing 2015 Google results: steer agents away from the generic middle — _Stocko_ · 2026-09-16
- callm: a Python library adding retries, caching, budgets and guardrails around native LLM SDKs — MassiveFinish3510 · 2026-09-16
- Open-Source iOS App Lets Your Laptop Agent Build and Drive Mobile Mini-Apps — nawal_es · 2026-09-16
- Open-sourced Qwen-2.5-1B-RLCD delivers up to 70x speedups for type-safe JSON inference — victormustar · 2026-09-16