Database Design, Tenant Isolation, and Vector Storage
Store application records—users, conversations, jobs, tool actions, documents, and evaluation results—in a conventional database. Store vectors in a vector database or an appropriate extension when needed, but preserve source IDs and access metadata. The choice depends on scale, filtering needs, operational expertise, consistency requirements, and cost.
Tenant isolation should be enforced in the data access layer, not merely in prompt construction. Queries must include the authenticated tenant/user scope, and indexes should support those filters. For high-sensitivity workloads, consider separate schemas, databases, or infrastructure based on threat model and compliance needs.
Tenant-scoped query
const document = await db.documents.findOne({
id: requestedDocumentId,
tenantId: authenticatedUser.tenantId,
deletedAt: null
});💡 The tenant ID comes from authenticated server context, not from an untrusted request field. Return a not-found result when the document is absent or not visible to avoid leaking existence information.
Key Takeaways
- Use conventional storage for application state and vector search for semantic retrieval.
- Scope every data operation by authenticated identity and tenant.
- Test cross-tenant access attempts explicitly.
Knowledge Check
Where should tenant isolation be enforced?