Top-k means different things depending on where the filter runs. If ANN explores the global graph and the engine applies a tenant predicate afterward, most visited candidates belong to someone else. With a one-percent eligible fraction, 40 roughly uniform visited candidates would yield less than one eligible candidate on average. Real neighborhoods are not uniform, so even that estimate is only a diagnostic sketch. Increasing the number of returned hits does not necessarily make the ANN traversal examine more candidates. pgvector's documentation explicitly describes post-scan filtering for approximate indexes and iterative scans that explore farther up to a configured bound. Other engines may push filters into search differently, so first inspect the actual plan and visited, filtered and returned counts.

For small tenant subsets, filter by tenant with an ordinary index and compute exact vector distance over those eligible rows. That can be faster and more accurate than walking a large global ANN graph. For larger stable tenant partitions, a per-tenant index or partition may make the search space match the eligible corpus, but hundreds of tiny indexes have build and operational costs. An iterative or filter-aware ANN path is another option. Choose from measured eligible-set size, memory, p99 latency, update rate and recall against exact nearest neighbors in the eligible set. Do not compare with global unfiltered recall and declare the tenant search healthy.

Now the user's group membership changes. Tenant partitioning is only a coarse boundary. It does not prove this principal can see every chunk inside the tenant. Apply the current permission rule before private text reaches reranking or generation, and recheck at the disclosure boundary under the bank's revocation policy. If the engine can search only a stale materialized ACL, it may return too few hits or leak through a later stage unless current authorization remains authoritative. A permitted result missing from top-k is a quality failure. A restricted result shown to a model is a security failure. They need separate tests.

I would replay queries at one-percent and much lower selectivity, with new and revoked group memberships, skewed tenants, and high update load. Record search effort, allowed recall@20 versus an exact oracle, result count, p99 and authorization decisions. In the question about a restricted top search hit, the restricted hit is already ranked and we decide what the generator may see. Here the eligible neighbor never made the result set. That is an earlier failure.