Retrieval scope belongs in the query, not in the filter
Filtering vector search results by user looks equivalent to scoping the search itself. It is not, and the difference shows up as both a security property and better recall.
If you are building recall over data belonging to more than one user, there are two ways to keep them apart. You can search everything and filter the results, or you can scope the search so other users’ material is never a candidate. These look equivalent. They are not.
Filtering makes correctness a runtime property
With post-retrieval filtering, isolation holds only if the filter is applied correctly on every path, every time, including the debug endpoint somebody added last month and the new ranking step that reorders results. Every code path that touches retrieval becomes a place where isolation can break, and the failure is silent: you get plausible results that happen to belong to someone else.
Scoping the query moves that guarantee into the data access layer. Material outside the scope is not ranked, not returned, and not present in anything downstream. There is no path where forgetting a filter leaks data, because there is no filter to forget.
It also improves recall
This is the part that surprises people. Scoped search is usually better, not just safer. Similarity scores are relative to the corpus being searched. In a shared index, every new tenant adds material that competes for the top results, so a query that worked well at ten users returns worse matches at ten thousand. Scoped to one user’s own corpus, the same query is competing against a small coherent set, and the top results stay relevant as the overall system grows.
A shared index dilutes with every new account. A scoped one does not notice them.
What this looks like in practice
On Synca we scoped per user. On the hosted research platform we threaded the same boundary through the whole run lifecycle, so intermediate state carried it too. For a professional services firm the same pattern applies per matter. The unit changes, the principle does not: whatever your isolation boundary is, put it in the query.
The cost is that you have to decide what the boundary is before you build, rather than discovering it later. That is a feature.
Rubatt engineering
We build agent systems for operations, sales, research and support teams. Everything here comes from something that broke in production first. Reach us at hello@rubatt.com.