Implementation guide
OWASP AISVS v1.01
Memory, Embeddings & Vector Database Security · Access Controls on Memory & RAG Indices
Keep each tenant's vectors separate
Verify that vector identifiers and namespaces enforce uniqueness per tenant and prevent cross-tenant collisions.
OWASP AISVS v1.01, requirement 8.1.1
In plain English
In a vector store shared by several tenants, make every identifier and namespace unique to its tenant. If two tenants can produce the same ID, one can overwrite the other's data, or have their content served in the other's search results.
What good looks like
- Each tenant has its own namespace, collection or index.
- Vector IDs include the tenant identifier or are generated so they cannot clash.
- Every write is checked against the caller's verified tenant before it is accepted.
- A test shows that writing an existing ID from another tenant fails or creates a separate record.
How teams usually do it
- A namespace, partition or collection per tenant, a feature most vector databases provide.
- IDs built by the ingestion service as tenant ID plus a generated UUID. Clients never supply raw IDs.
- A thin data-access layer that sets the tenant from the authenticated request, so application code cannot leave it out.
Suggested evidence
- The schema and ID format.
- Write-path code showing the tenant check.
- Results of a cross-tenant collision test.
Common mistakes
- Using document filenames or sequential numbers as IDs, which collide across tenants.
- Taking the tenant ID from a request parameter the client controls.
- One shared collection with a tenant field that some code paths forget to filter on.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.