Test tenant isolation by sending semantically similar requests from distinct authenticated tenants and verifying that one tenant’s cached private answer cannot be returned to the other. A similarity threshold is not an authorization check.
Use the same wording and different private facts
Create two synthetic accounts with different order statuses. Ask each account the same question about its order. A semantic matcher may consider the questions identical, yet the correct answers and permitted evidence differ. Keep the tenant identity derived from trusted authentication rather than model-proposed fields.
Probe every cache entry point
- Test exact lookup, semantic nearest-neighbor lookup, refresh, and fallback paths.
- Verify filtering is enforced before a private cached response becomes accessible to the caller.
- Check source permissions and version dependencies as well as tenant identity; some records have narrower scopes within a tenant.
- Exercise deletion, role changes, and a formerly authorized user who has lost access.
Read the adversarial cache hit
The example includes an unauthorized entry with a higher similarity score than the permitted entry. Sorting all candidates and trusting the highest score returns the wrong tenant’s answer. Filtering to the authenticated tenant before selection preserves the boundary in this in-memory illustration.
What the fixture cannot prove
A tenant field comparison is not a complete multi-tenant security design. Real indexes, cache keys, network boundaries, and administrative paths need tests using the actual authenticated sessions and data stores. Do not expose private candidate contents in debug logs while investigating a cache leak.
Run the worked example
Save the synthetic Node.js example and run node test-semantic-cache-tenant-isolation.mjs with Node.js 22 or newer. The assertions check the illustrated records and calculations; they do not test a deployed provider, SDK, or access control. No credentials or network connection are needed.
// Synthetic teaching fixture. No credentials, network calls, or production verification.
import assert from 'node:assert/strict';
const actor = { tenant: 'tenant-a' };
const candidates = [
{ tenant: 'tenant-b', similarity: 0.99, answer: 'Private B order' },
{ tenant: 'tenant-a', similarity: 0.97, answer: 'Private A order' },
];
const unsafe = [...candidates].sort((a, b) => b.similarity - a.similarity)[0];
const safe = candidates.filter(c => c.tenant === actor.tenant).sort((a, b) => b.similarity - a.similarity)[0];
assert.equal(unsafe.tenant, 'tenant-b');
assert.equal(safe.answer, 'Private A order');
assert.equal(safe.tenant, actor.tenant);
console.log('Highest similarity crossed tenants; authorized selection did not.');
References and further reading
Maintained by DriftRail. AI assisted the October 2026 content and template revision. Examples are illustrative; they are not measured product benchmarks. Suggest a correction.