One customer's content must never reach another's answer. We treat that as the failure that ends the company, so it is enforced physically rather than by a filter that could be wrong.

• Each tenant has its own index, its own storage prefix and its own derived encryption key
• Every query carries a tenant identifier, and the tenant of every returned document is asserted against it
• A mismatch aborts the entire response. It is not a filtered result

That last point is deliberate and it costs us availability. If the assertion fires, isolation has already failed somewhere upstream, and returning the other results would serve a partial answer over a broken boundary — hiding the breach behind a page that looks fine.

Enforced in the permission core and covered by the adversarial suite; see the benchmark for the current pass rate.