4 articles on this topic.
Don't concatenate WHERE tenant_id. inject_filter wraps untrusted QQL in a root AND so OR and NOT cannot skip isolation.
Qdrant trusts the client filter. Inject tenant predicates into the query AST so agents cannot skip isolation, even under prompt injection.
RLMs treat long context as a REPL, not a stuffed window. Let the agent write Qdrant queries, then inject tenant filters before search.
Don't build a custom identity provider for login. Use a real IdP for AuthN and keep authorization in your own control plane.
