similarity is access: control vector geometry, not just documents.
The threat
weaknesses of the RAG vector storage and retrieval layer: embedding inversion (recovering part of the source text from a vector), semantic collisions (distinct contents sharing a neighborhood), similarity leakage (a neighboring query returns content from another scope), partition bypass through close queries (probing the neighborhood to exfiltrate from a supposedly isolated index).
Blind spotWhy classic frameworks miss it
a vector index is a database of similar objects, not a per-document ACL store: similarity IS access. Classic grids audit document-level read permissions, never what a neighbor query reveals nor how reversible embeddings are.
MitigationProposed approach
access control on the vector store and embedding endpoints (caller identity on every query), physical/logical per-tenant isolation, similarity thresholds plus membership check before returning results, inversion tests (assess reversibility of sensitive embeddings), monitoring of neighborhood probing, do not index sensitive data in reversible embeddings.
The proposed control
a vector lets you neither reconstruct nor retrieve data outside its scope.
Expected evidence
intra and inter-tenant inversion and neighbor-query tests; no proven leak.