Your RAG Filter Runs Too Late. Build a Tenant-Safe Retriever in TypeScript.

Your RAG system finds the two highest-scoring documents. Then it checks whether the user can read them. Both belong to another tenant. You drop them and tell the user there is no answer. But there were three useful documents the user could read. They never made the candidate list. That is a retrieval bug. If those first two documents reached an external reranker before you dropped them, it is also a data-boundary bug. Let's build the smallest version that makes both mistakes visible.