---
title: "Scope what the model can look up to the · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/scoped-retrieval
updated: 2026-10-20
licence: "All rights reserved"
---

# Scope what the model can look up to the user

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [AI agents and models](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models)
- Rule: Let the model find only the documents and records the current user may read. Never search one shared index across all customers.
- How: Filter every search by the user's rights before the results reach the model. Store each customer's data with an owner field and filter on it in the query. Do not ask the model to leave things out, because it cannot be trusted to.
- Check: Log in as test customer A and ask about a document that only customer B has. The answer shows nothing from it.

Example:

```js
const hits = await index.search(question, { filter: { tenantId: user.tenantId }, limit: 5 });
```

```python
hits = index.search(question, filter={"tenant_id": user.tenant_id}, limit=5)
```

```sql
-- PostgreSQL with pgvector: the filter is part of the query
SELECT id, body FROM documents WHERE tenant_id = $1 ORDER BY embedding <=> $2 LIMIT 5;
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/scoped-retrieval`.

- Previous: [Keep secrets out of the system prompt](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/no-secrets-in-prompt)
- Next: [Allow only reviewed tools and servers](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/pinned-tools)
- [AI agents and models](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models)