A county assessor's vector database lacks tenant isolation between public parcel FAQs and sealed appraisal notes. What isolation control should security enforce?

Separating collections with access controls so sealed appraisal vectors cannot be retrieved for public FAQ queries is the right isolation control. The assessor’s vector database holds two different confidentiality classes: open parcel FAQs and sealed appraisal notes. Without tenant or collection isolation, a public FAQ query can retrieve nearest neighbors from the sealed set and leak privileged valuation material into a public answer. Distinct collections plus enforced query-time access controls keep sealed vectors unreachable from the public retrieval path.

Storing both corpora in one collection and relying on the LLM to refuse sealed content fails by concept: the model is not a reliable gate once sealed text is already in context, and refusal prompts are not substitutes for retrieval isolation. Publishing sealed appraisal notes to the open-data portal fails because that expands disclosure rather than protecting sealed work product. Disabling embeddings and answering only from foundation-model pretraining fails because assessor answers must ground in authoritative local parcel content; pretraining neither contains sealed notes safely nor replaces controlled municipal knowledge with public-safe FAQs.

Exam caveat: Treat vector collections as security boundaries. “The model will refuse” is not isolation when sealed and public civic content share one searchable space.

Operational check: Place public FAQ and sealed appraisal embeddings in separate collections, bind public FAQ clients to the public collection only, attempt cross-retrieval of sealed tokens from the FAQ path and confirm denial, and review access policies with assessor counsel before go-live.