agentsop-multi-tenant-rag
Security-first SOP for multi-tenant RAG systems. Activate when a calling agent is building, reviewing, or debugging any retrieval pipeline whose vector store is shared across more than one user, organisation, workspace, customer, or permission scope. Encodes the single non-negotiable rule — **filter at the vector store query, never after retrieval / never after rerank** — together with the per-vendor query-time filter APIs (Pinecone namespaces + `$eq`/`$in`, Weaviate `multiTenancyConfig` + tenant handle, Qdrant `is_tenant` payload index + `Filter.must`, Chroma `where`, pgvector RLS), and the c
npx skills add agentsope/SkillAlchemy --skill agentsop-multi-tenant-rag --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Activates to enforce a strict multi-tenant isolation policy for retrieval pipelines whose vector stores are shared across tenants. It requires embedding a tenant key in every vector store ingestion and, crucially, applying a tenant-based filter at query time (not after retrieval) across supported vendors and adapters. It frames the work as preventing cross-tenant leakage and provides concrete vendor-specific guidance and templates to enforce the rule at the query boundary.
How it works
The skill prescribes stages to ensure proper isolation:
- Stage 1 picks a vendor-appropriate isolation primitive (namespace per tenant for Pinecone, multiTenancyConfig with tenant handle for Weaviate, is_tenant and Filter.must for Qdrant, and a tenant filter for others).
- Stage 2 mandates embedding the tenant_id from the authenticated session into each vector’s metadata at ingestion, refusing ingestion if tenant_id is missing.
- Stage 3 instructs applying a query-time filter that uses the session tenant_id for every retrieval call via the vendor’s filter mechanism or the corresponding framework adapters (e.g., MetadataFilters in LangChain/LlamaIndex).
- Stage 4–8 provide tests, defense-in-depth measures, audit logging, and post-retrieval checks to prevent leaks and verify ongoing compliance.
The policy emphasizes that the boundary is the query call; any filtering after retrieval is considered unsafe and non-compliant. It includes concrete code patterns for embedding tenant_id and for constructing a tenant-based filter on queries.
When to use it
Use when the retrieval corpus is shared across more than one tenant/organization/workspace/user, or when reviewing changes to vector_store.query, index.as_retriever, similarity_search, or vectorstore.query_points. It is activated for PR reviews touching multi-tenant contexts and when auditing any new RAG endpoints that expose retrieved content to end users.
What it can touch
The skill specifies vendor-specific filter APIs and cross-framework adapters that the agent should use: Pinecone namespaces, Weaviate multiTenancyConfig with tenant handle, Qdrant is_tenant payload index and Filter.must, Chroma where, pgvector RLS, and cross-framework adapters like LangChain filter= dict and LlamaIndex MetadataFilters. It also references code patterns for applying a tenant_id filter in query constructors.
Caveats
License: MIT. Activation requires that the corpus is not fully public and that per-tenant isolation is feasible via the vendor’s primitives. If a per-tenant index/collection already enforces isolation and cannot be overridden by the app, the skill notes that such cases may not need additional in-code filtering. It warns against relying on post-retrieval filtering and emphasizes embedding the tenant key at ingestion time.
# Multi-Tenant RAG · Security-First Isolation SOP > Third-person operating model for a coder agent that owns retrieval correctness > across tenant boundaries. The audience is the LLM agent writing or reviewing > the code — not the end user. > **One sentence**: *Isolation lives at the vector store query boundary, not > at the model. Anything that reaches the LLM's context window has already > leaked.* --- ## 1. 何时激活 (Activation Rules) Activate this skill whenever **any** of the following holds: 1. The codebase contains a retrieval call (`vector_store.query`, `query_points`, `similarity_search`, `as_retriever().retrieve(...)`, raw `pgvector` `ORDER BY embedding <-> $1`) **and** the corpus serves more than one tenant, customer, organisation, workspace, user, or permission scope. 2. The user mentions any of: multi-tenant RAG, namespace, tenant, workspace, `tenant_id`, `org_id`, `user_id`, "cross-customer", "shared index", "knowledge base per team". 3. A bug report says "User A saw User B's document", "wrong company's data surfaced", "the assistant cited a doc I don't have access to", or anything that smells like cross-context bleed. 4. PR review: any new code calling a vector store **w
- 1. 何时激活 (Activation Rules)
- 2. 核心心智模型 (Core Mental Model)
- Principle 1 — Isolation lives at the boundary, not at the model
- Principle 2 — Embed the tenant key at ingestion, not just at query
- Principle 3 — Defence in depth: namespace and filter, not namespace or filter
- 3. SOP 工作流 (Agentic Protocol)
- Stage 0 — Threat-model the boundary
- Stage 1 — Pick the isolation primitive (vendor-specific)
- Stage 2 — Ingestion: write the key, lock the schema
- Stage 3 — Query-time filter (the only place the rule applies)
- Stage 4 — Cross-tenant property test (the gate)
- Stage 5 — Defense in depth (Principle 3)
- Stage 6 — Audit logging
- Stage 7 — Cache / rerank / postprocessing audit
What does the agentsop-multi-tenant-rag skill do?
Security-first SOP for multi-tenant RAG systems. Activate when a calling agent is building, reviewing, or debugging any retrieval pipeline whose vector store is shared across more than one user, organisation, workspace, customer, or permission scope. Encodes the single non-negotiable rule — **filter at the vector store query, never after retrieval / never after rerank** — together with the per-vendor query-time filter APIs (Pinecone namespaces + `$eq`/`$in`, Weaviate `multiTenancyConfig` + tenant handle, Qdrant `is_tenant` payload index + `Filter.must`, Chroma `where`, pgvector RLS), and the c
How do I install it?
Run `npx skills add agentsope/SkillAlchemy --skill agentsop-multi-tenant-rag --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From agentsope/SkillAlchemy, a repository with 255 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.