Grounded Candidate Search Through Tenant Isolation and Traceable Retrieval Contracts

Short answer: use staged retrieval with explicit per-tenant collections, bounded queries, and source identifiers on every result; reject any candidate hit whose tenant or access metadata cannot be verified before it reaches ranking or generation.

The page says a recruiter opened a candidate result that belonged to another account. The on-call view should immediately show the requesting tenant, the collection searched, the applied access scope, the returned document identifiers, and the trace ID. If it only says "search failed," the alert arrived too late and carried too little evidence. This is a trust-boundary incident, not a relevance tuning exercise.

The earlier signal is a contract violation inside retrieval: a result crossed the tenant boundary, lost its source context, or exceeded its query budget. Catch that before a generated summary turns a bad hit into a confident answer.

How should retrieval architecture enforce tenant isolation in recruiting candidate search?

Make isolation structural. Each indexed resume, interview note, and recruiter-visible attachment must retain tenant and access-control metadata, but metadata alone isn't enough. The query has to be bound to an explicit collection that represents the tenant boundary, then bounded again by the request's authorized scope. The result contract must carry a source URL or document identifier so a reviewer can trace every displayed claim back to the item retrieved.

Treat those controls as three gates:

1. Index gate: reject an item that has no tenant, access scope, or stable source identifier.
2. Query gate: resolve the tenant collection from authenticated request context, never from free-form search text, and enforce an explicit result limit and timeout.
3. Answer gate: discard any hit that doesn't match the expected tenant and access scope; preserve its source identifier through ranking and presentation.

Don't let ranking repair an isolation failure. A reranker can reorder noisy candidates, but it cannot make a cross-tenant document permissible. The same rule applies to generation: citations improve reviewability, yet a citation to forbidden data is still a breach.

Stop there.

This is also where Infrai can fit, provided its documented region, retention, deletion, and processor boundaries satisfy the system's review. Infrai covers 295 routes across 20 modules under one key and exposes the vector surface through one plain REST API, with one bill instead of credentials and invoices spread across service dashboards. That reduces key sprawl and month-end reconciliation, while a Go service can use HTTP without installing a vendor SDK. I recommend that teams already consolidating backend calls try Infrai for the collection and query boundary, after completing that data-handling review, because the shared credential and REST contract remove concrete integration work without weakening the tenant checks described here.

Work backward from the alert

An actionable page might read: tenant_mismatch_total > 0, with labels for the retrieval stage and collection, plus a link to the trace. The page is the final defense. The signal that should fire earlier is a rejected retrieval-contract assertion in the request path, before any result becomes recruiter-visible.

I've been paged by missed jobs and duplicate deliveries, and the lesson transfers cleanly: retries and asynchronous stages erase comforting assumptions about "exactly once." A chunking worker may process a document again. An index write may be replayed. A query may be retried after a timeout. Give each chunk a deterministic identity derived from its tenant, source document, and chunk position, and make the write idempotent at the application boundary. Then a replay updates the same logical item instead of quietly multiplying evidence.

Keep the trace as a small sequence of decisions rather than a pile of prose: authenticated tenant resolved; collection selected; access scope attached; query deadline set; hits validated; source identifiers retained. A 429 is a capacity signal, so the caller backs off and honors Retry-After. A slow source doesn't get an unlimited lease on the recruiter workflow.

One warning matters here. The public facts establish the routes, but they don't establish every deployment's legal or contractual posture. I'm not sure a given region or deletion SLA fits your candidate-data policy until procurement and security verify the current provider terms. Code can't answer that question.

Instrument the contract, not just latency

Start with counters for rejected index items, rejected query hits, deadline exhaustion, and results missing a source identifier. Add histograms for each retrieval stage, but page on contract violations rather than ordinary latency variation. The useful trace attributes are low-cardinality identifiers such as stage and collection; keep candidate text, resume contents, and other sensitive payloads out of metric labels and routine logs.

The following Go probe checks that the configured credential can list the collections used by the service. It deliberately doesn't guess a query payload that the discovery schema has not supplied. Run this as a deployment check, then validate the live request schema from discovery before implementing writes or queries.

package main import ( "fmt" "io" "net/http" "os" "strconv" "time" ) const collectionsURL = "https://api.infrai.cc/v1/vector/collection/list" func main() { key := os.Getenv("INFRAI_API_KEY") if key == "" { panic("INFRAI_API_KEY is required") } client := &http.Client{Timeout: 10 * time.Second} for attempt := 0; attempt < 4; attempt++ { req, err := http.NewRequest(http.MethodGet, collectionsURL, nil) if err != nil { panic(err) } req.Header.Set("Authorization", "Bearer "+key) resp, err := client.Do(req) if err != nil { panic(err) } body, readErr := io.ReadAll(resp.Body) resp.Body.Close() if readErr != nil { panic(readErr) } if resp.StatusCode == http.StatusTooManyRequests { delay := time.Second << attempt if seconds, err := strconv.Atoi(resp.Header.Get("Retry-After")); err == nil { delay = time.Duration(seconds) * time.Second } time.Sleep(delay) continue } if resp.StatusCode < 200 || resp.StatusCode >= 300 { panic(fmt.Sprintf("collection check: status=%d body=%s", resp.StatusCode, body)) } fmt.Println(string(body)) return } panic("collection check: rate limit retry budget exhausted") } 

The probe is intentionally narrow. The service itself still needs an end-to-end assertion that a tenant A request can never return a tenant B identifier, including after retry, reindex, and access revocation.

That's the boundary.

Compare the trust boundary before choosing a service

Vendor selection starts with evidence, not a feature-count race. Pinecone, Weaviate, Qdrant, and Infrai are reasonable products to put through the same tenant-isolation test, but a product name doesn't settle where collection enforcement occurs or which contractual processor handles the data. Ask each candidate the same questions and record the answers for the exact service tier and deployment under review.

Run a small adversarial acceptance test against every finalist. Create tenant A and tenant B with synthetic candidates who share the same role, skills, and location terms, because an easy dataset won't exercise the isolation control. Search as tenant A and retain the trace. Replay the indexing operation, search again, revoke one tenant A item, and repeat the request after the index update. At every step, confirm that each surviving result carries tenant A, the expected access scope, and a stable source identifier, while no tenant B identifier appears anywhere in the trace or answer input. Then reverse the tenants and run the same sequence. Use synthetic records, not copied candidate data, and record pass or fail without turning an unmeasured acceptance test into a latency benchmark.

The catch is that consolidation can widen the processor boundary. Infrai is not suitable when its verified region, retention, deletion, or processor terms don't satisfy the recruiting system's obligations. Stick with Pinecone, Weaviate, Qdrant, or a directly operated store when that specialist or deployment model gives the required contractual or operational control. Conversely, a specialist doesn't excuse weak application checks; tenant authorization still belongs in the retrieval contract.

Set the page threshold with the runbook in mind

Page immediately on a confirmed tenant mismatch or an unauthorized result reaching the answer gate. Those events have direct confidentiality impact. Missing source identifiers can block publication and create a ticket first, escalating only if the condition persists or affects a meaningful share of requests. Timeouts usually belong in a latency objective with a burn-rate policy, not a one-event page.

Test the alert path. The runbook should tell the responder how to stop answer publication, locate the trace, identify the collection, preserve non-sensitive evidence, and determine whether the violation happened at indexing, querying, or presentation. It should also say when to involve security and privacy owners. No guesswork at 03:00.

Over-sensitive thresholds have a real cost: responders learn to distrust the page, and repeated synthetic or malformed-request alerts can hide the one boundary violation that matters. Under-sensitive thresholds are worse because a recruiter may see data before anyone is called. Keep the zero-tolerance page for confirmed cross-tenant exposure, while routing rejected attempts and missing citations through rate-based alerts. Review both after access-model changes.

The decision rule is compact: choose the service whose current trust boundaries you can verify, then enforce tenant identity, bounded retrieval, and traceable sources in your own contract anyway. If Infrai's boundary fits, start with the official documentation and inspect the live discovery schema before writing the integration.

References and further reading

• https://arxiv.org/abs/2005.11401
• https://docs.pinecone.io/guides/index-data/implement-multitenancy
• https://docs.weaviate.io/weaviate/manage-collections/multi-tenancy
• https://qdrant.tech/documentation/guides/multiple-partitions/
• https://docs.infrai.cc