Cloudflare AI Search tenant isolation matters as soon as the same application serves organizations with private documents. A retrieval result can leak information before an answer is generated, and a citation can expose a document even when the visible answer looks harmless. The permission boundary must cover the whole search journey.
Derive tenant scope from authenticated application identity, then select the permitted search instance or apply mandatory server-controlled filters. Keep ingestion, retrieval, citations and caches inside the same access design. Prove isolation with negative tests, including tenant switching, stale sessions and direct attempts to open another tenant’s source.
Imagine a SaaS product that lets distributors upload supplier agreements. Each distributor wants an assistant to explain its own delivery and discount terms. The product may also have a public manual shared by everyone. Combining those sources is useful only if private material never crosses the intended boundary.
This is a proposed application design and acceptance approach. It is not a claim that a namespace or filter alone satisfies every security requirement.
Cloudflare AI Search tenant isolation begins before retrieval
Cloudflare’s multitenancy guide documents separate-instance and shared-instance approaches to tenant search. The architecture choice needs an application identity model first. Decide what a tenant represents and which users can act within it.
Obtain the tenant from a verified session or equivalent trusted context. A request parameter can indicate what the user wants to select, but the server must establish that the selection is permitted. Never let the model supply the authoritative tenant scope.
For a colleague who belongs to several distributors, make the active organization explicit. Switching organizations should change the permitted source set and any associated conversation context. A private passage retrieved before the switch should not quietly remain in the next answer.
| Boundary | Trusted input | Untrusted substitute to reject |
|---|---|---|
| Tenant selection | Authenticated membership and active scope | Arbitrary tenant identifier from the browser |
| Instance routing | Server-controlled mapping | Instance name invented by the model |
| Document scope | Verified source ownership and permissions | Uploaded file claiming its own tenant |
| Citation access | Current authorization at document opening | Possession of a result URL alone |
Compare instances and mandatory filtering
Separate instances can make the data boundary easier to inspect, but they add lifecycle and provisioning work. A shared instance can reduce that overhead, but every relevant retrieval path must apply the correct scope without an optional bypass.
Cloudflare’s namespace documentation explains how instances are grouped and accessed through bindings. Review the binding’s scope carefully. A logical grouping is not proof that your application routes every caller correctly.
| Design choice | Operational benefit to assess | Responsibility that remains |
|---|---|---|
| Separate tenant instances | Clearer source and lifecycle separation | Correct routing and membership checks |
| Shared instance with tenant filters | Shared ingestion and index management | Mandatory scope on all retrieval paths |
| Separate public collection | Explicit shared material | Prevent private ingestion into that collection |
| Restricted document subsets | Finer access within a tenant | Current document-level permissions |
Choose from the permission model and operating requirements, not only the number of tenants. A tenant with internal restricted teams may need more than an organization-wide boundary regardless of the instance layout.
Apply scope during ingestion as well as queries
Document ownership must be established when content enters the system. Associate each source with its tenant and intended visibility using trusted application metadata. Do not accept an upload’s claimed ownership without checking the caller’s authority.
Keep source identifiers stable across updates. A replacement agreement should update the intended tenant’s material, and deletion should target the correct source and derived content. An identifier collision between tenants can corrupt isolation even before search runs.
Separate public and private ingestion decisions. A shared manual can be deliberately public; a supplier agreement should not enter that collection because its file extension or folder name resembles a manual.
Record which ingestion identity can read each source location. An application can correctly filter its results while an overly broad source connector still imports material it should never process. Scope review must include both sides of the pipeline.
Make filters non-optional application policy
Cloudflare documents retrieval filtering . Translate the current application permissions into the selected filter contract and test the actual request generated by the server.
Do not expose a generic filter object that an ordinary client can replace. Likewise, do not add a convenience fallback that retries without filters when the scoped query returns no matches. No result is a valid and necessary outcome for unauthorized or absent information.
Keep application scope separate from user preferences such as document type or language. The user can request a narrower search, but should not be able to remove the mandatory access condition by changing a search option.
Test every route that reaches retrieval: search results, generated answers, exports, agent tools and administrative previews. A secure search page does not compensate for an unfiltered tool endpoint that queries the same collection.
Protect citations, caches and conversation history
A generated answer can omit a private passage while still returning a citation title or URL that exposes another tenant’s information. Check all returned fields, not only the answer text.
Open citations under current document authorization. If the source is served through your application, verify the caller before returning it. If it uses an external document system, establish that the link preserves that system’s access rules.
Include tenant and relevant permission context in any application cache design. A cached answer appropriate for one organization must not become a shared answer merely because the question text matches.
Conversation history can retain retrieved passages after a user changes organizations or loses access. Decide which history may be reopened and which context can be supplied to the model. Revocation should have a defined effect on derived copies, not just the live search query.
Build negative tests that reveal real leakage
Use synthetic tenant documents with distinct, unmistakable markers. Ask the same question as users in different organizations, and assert that the other organization’s marker never appears in passages, answers, metadata or citations.
| Test | Expected result |
|---|---|
| Alter the requested tenant identifier | Server rejects or retains the permitted scope |
| Query a known phrase from another tenant | No private passage, answer or citation is returned |
| Open another tenant’s document URL | Access is refused |
| Switch active organization | Retrieval and model context follow the new permitted scope |
| Remove membership during a session | Further access follows current authorization |
| Repeat a cached question across tenants | No cross-tenant answer reuse |
Include an authorized multi-tenant administrator separately from ordinary users. Administrative troubleshooting needs its own authority and evidence. Do not normalize an administrator’s broad results into the ordinary-user acceptance test.
Repeat the isolation set after changes to routing, ingestion, filtering and caching. Search relevance testing alone will not detect a permission regression; a very relevant result can be precisely the document the user must not see.
Budget for the permission lifecycle
Development effort depends on membership, document permissions, source integration and the number of retrieval routes. A simple tenant filter demonstration excludes much of the lifecycle work required by a real SaaS product.
Request a GBP proposal that includes provisioning, tenant changes, deletion, revocation and acceptance. State whether isolation stops at the organization boundary or includes teams and individual documents within it.
| Work area | Evidence to request |
|---|---|
| Identity | Tenant membership and switching rules |
| Ingestion | Verified ownership and source access mapping |
| Retrieval | Server-controlled scope on every route |
| Derived content | Cache, citation and history policies |
| Operations | Provisioning, deletion and incident runbooks |
A bounded AI integration pilot can test synthetic organizations and representative documents before private data is introduced. Request a tenant-search proposal with your membership model and source permissions. That makes isolation a testable contract rather than a reassuring label on the architecture diagram.
Frequently Asked Questions
Does each tenant need a separate AI Search instance? Not necessarily. Cloudflare documents separate-instance and shared-instance approaches. Compare the permission model, provisioning work and the reliability of mandatory filtering before choosing. Neither approach removes application authorization.
Can the browser send the tenant identifier? It can request a selection, but the server must verify that selection against authenticated membership. Do not treat an arbitrary browser parameter or model-generated value as the source of access authority.
Are namespaces an authorization system? Namespaces organize access to instances through the documented binding model. Your application still needs to authenticate callers and route them correctly. Review binding scope and prove the boundary with ordinary-user negative tests.
Should an empty filtered search retry without the filter? No. Removing mandatory scope to obtain an answer can expose another tenant’s material. Return a useful no-result outcome or investigate the indexing and permission configuration without widening the user’s access.
Can citations leak information? Yes. Titles, URLs, excerpts and document downloads can reveal private information even when the generated answer omits it. Test the complete response and require current authorization when a source is opened.
What happens when a user loses tenant membership? Further access should follow current permissions. Define the effect on open sessions, cached answers, conversation history and derived copies as well as live retrieval. Test revocation during an active session.
What should an isolation pilot prove? It should prove that ordinary users cannot retrieve, infer through returned metadata, or open another tenant’s private sources. Include scope tampering, tenant switching, cache reuse, source updates and revocation.