15:I[981,["658","static/chunks/658-a698693f56d0116a.js","183","static/chunks/183-6beeeb801c274aaa.js","474","static/chunks/app/%5Btype%5D/layout-631c4730b83c8223.js"],"Posts"] 16:T48d,RAG works well in simple setups, but is it matter once you run in multi-tenant systems.

Many implementations retrieve broadly and rely on filtering later. From a security perspective, that can be uncomfortable. Once data is touched during retrieval, it’s hard to say the system never accessed something it shouldn’t have.

In practice, organizations often have layered access: parent-level policies, branch-level rules, roles, and documents that are only valid for certain periods. If that structure isn’t modeled explicitly, enforcing boundaries becomes inconsistent.

My approach that helped was treating access rules as a gate before retrieval. Only documents that already meet tenant scope, role visibility, and policy constraints are eligible for similarity search.

This reduces the risk of accidental exposure and avoids relying on prompts or model behavior as a security control.

The model becomes a consumer of already-approved context, rather than part of the enforcement path.

It’s less about stronger AI and more about clearer boundaries in the data model.

Interested in how others think about this trade-off in production.

— Arty17:T4a0,Hi HN,

Over the past few days I built a small client-only web app that turns a name (or multiple names) into a deterministic color gradient.

The idea was to treat names as identity-rich input and map them to a repeatable visual “fingerprint.” The same input always produces the same gradient — no randomness, no accounts, no backend. Everything runs in the browser.

Under the hood, the app normalizes the input text, hashes it, and uses the result to seed a PRNG that drives color selection and layout. Because of that, even small changes (adding a middle name, punctuation, multiple names, etc.) result in noticeably different gradients, while staying perfectly stable across re

The First Day of the Cenozoic

Toddlers expect ingroup loyalty to override personal prefs when outgroup present

Early signals that EU AI Act compliance is becoming a sales blocker for AI SaaS

I'm Always in the Club

Solving Automata Cam Profiling with Grasshopper

Everyone Is Oppressed, Especially the Powerful

Hyundai to supply 50k vehicles to Waymo as physical AI move accelerates

Community Living as a Solution to Late Stage Capitalism

Flicker: Upload Videos for Free

Ball Lightning Phenomenon

Chrome Announced WebMCP Integration

FDA refuses to review Moderna's mRNA flu vaccine

Cloudflare forecasts annual sales above estimates as AI drives cloud demand

RAG and Data Boundaries in Multi-Tenant Systems

2026 Is the Year of Serious AI Engineering

The future of coding agents is vertical integration (and why ACP matters)

Built a Python Dependency Audit Tool Because Vulnerability Lists Weren't Enough

Elon Musk's xAI loses second cofounder in 48 hours

Google Chrome 145 Released with JPEG-XL Image Support

Sodium Ion Battery Puncture Test [video]

Scientists reimagine a forgotten battery design from Thomas Edison

Rivian R2: Electric Mid-Size SUV

Show HN: ScanDo – A zero-UI camera that predicts your next action locally

Open Climate Risk

The insane biology of: The saltwater crocodile [video]

Google Chrome: WebMCP is available for early preview

Show HN: NameToGradient – deterministic gradients from text input

Jjdag: A Jujutsu TUI

Rules of mysterious ancient Roman board game decoded by AI

Modem

Show HN: Txtweb – serve a website from your domain's DNS TXT record