The vector index returns ten excellent unauthorized matches

A hypothetical knowledge search finds ten semantically excellent documents. All belong to a different tenant. Authorization correctly removes them, leaving an empty page even though the requesting tenant has relevant documents.

The security check did its job. The retrieval plan asked the wrong nearest-neighbor question.

Establish an exact answer before approximating

For $N$ vectors of dimension $D$, brute-force distance evaluation costs $O(ND)$ arithmetic plus memory traffic. Raw float32 vectors occupy $4ND$ bytes: one million 768-dimensional vectors alone require about 3.072 GB in decimal units, before indexes and metadata.

Choose the metric consistent with the embedding model. Cosine compares angle; inner product includes vector magnitude unless normalized; Euclidean distance measures another geometry. Do not mix embedding-model versions merely because their dimensions match. Preserve model/version identity and rebuild or query compatible spaces during migration.

Search less, accept measured misses

HNSW builds a layered proximity graph. Sparse upper layers guide navigation; a broader search at the lower layer explores candidates. Construction connectivity and exploration settings affect memory, build cost, latency, and recall. There is no universal logarithmic worst-case guarantee or fixed recall percentage for arbitrary data.

IVF-style indexes partition vector space and probe selected clusters. Product quantization compresses subvectors into codebook references; scalar quantization reduces precision per coordinate. Both save resources by changing distance accuracy, often followed by reranking with fuller representations. Keep the original or adequate reranking data if that is part of the quality plan.

Graph links, allocator overhead, metadata filters, duplicate generations during rebuild, and replicas add to $4ND$. Measure resident memory and build peaks rather than treating raw vectors as total capacity.

Filtering changes the search landscape

Global top-K then filtering can return fewer than K eligible results. Naively forbidding traversal through disallowed graph nodes can also disconnect paths to valid candidates. Use the engine's actual filter-aware/iterative strategy, increase candidate work when justified, partition for locality, or fall back to exact search on selective subsets.

pgvector documents that approximate-index filtering occurs after scanning and offers iterative scans that continue until enough results or configured limits are reached. That is a bounded mechanism, not a guarantee of K matches under every limit. pgvector filtering and iterative scans.

Authorization must still be applied at the final result boundary and must not leak cross-tenant payloads through logs or diagnostics. Retrieval optimization cannot relax that rule.

Evaluate the question the user asked

Recall@K compares retrieved neighbors with an exact eligible-set baseline under the same metric. Evaluate latency percentiles, filtered recall, candidate counts, and relevance judged on actual queries. High vector-neighbor recall does not prove useful semantic answers; the embedding and corpus can be wrong for the task.

Hybrid retrieval combines lexical evidence with vector similarity, often followed by reranking. Calibrate score fusion; raw BM25 and cosine scores are not automatically comparable. Version the index and metadata so a document deletion or permission change reaches the serving path correctly.

Build/rebuild under resource isolation where needed, measure index freshness, and define behavior for a model-version rollout. A blue/green index swap still needs a catch-up position and deletion handling like any derived view.

Mental model: approximate search trades work for measured candidate recall within a defined eligible set. “Nearest” is meaningless without the metric, model version, and eligibility boundary.

Transfer: a faster benchmark

---

Source trail: 17-vector-databases-and-approximate-nn. See the source map for consolidation and reference-retained material.