A semantic search system has already crossed its security boundary before generation begins: if retrieval admits another customer's chunk, no prompt can make that access legitimate afterward. Short answer: in a multi-tenant ask-your-docs SaaS, derive the customer identity from authenticated server context, bind both the embedding namespace and the mandatory metadata filter inside one retrieval interface, and make the resulting decision reconstructable from an audit record. This architecture d...