RAG document trust
Cross-tenant RAG is an authorization bug on retrieved chunks. If the index returns another tenant's text into a context you are allowed to see, the filter failed before the model spoke.
Tags: rag, tenant, llm
Level: advanced
Method
Find the retrieval path
Chat over docs, support search, and 'ask this workspace' are the usual surfaces. Note whether the product claims answers are limited to your org.
Tools: browser
Plant a document you own
Upload a unique sentence into org A. Ask from org A and confirm the sentence can come back. That is the control.
Tools: browser
Ask from org B
With a second org you own, ask for that same unique sentence. If org B receives org A's text, retrieval ignored the tenant.
Tools: browser
Separate refusal from retrieval
If the model refuses to quote the chunk but the application already fetched it into the prompt, the boundary failed. Say which layer you observed.
Tools: Burp Suite
Citations and attachments
A citation, download link, or chunk id that points at another tenant's file is the same bug with a different sink.
Tools: Burp Suite
Keep customer data out
Do not paste another customer's document into a report. A unique string you created is the evidence.
Tools: browser
Field notes
- Prompt injection is a different hunt. This page is the retrieval filter.
- A shared public corpus is not a tenant bug. Read what the product says is private.
- Embeddings are not authorization. The filter has to run before the chunk is shown.