Most alerts need a threshold. This one fires at one.

transcript

Most alerts wait for a rate, or a threshold. In this search system, one alert fires at one. One attempt, and someone gets paged.

Law firm A uploads a confidential merger contract. Firm B must never find it in search. Never open it by guessing its ID. Not even in facet counts. A count can leak that something exists.

So no single control is trusted. The gateway takes the tenant from the token. The request can't override it. The service injects a tenant filter on every query. Users never write it. Each firm has its own index. And document-level security checks the token again. Every search is audit logged, with anomaly detection.

Why five layers, if each firm already has its own index? Because a code path might query the wrong index. If one layer fails, the others still stop the leak.

And you prove it before every deploy. Firm B searches Firm A's exact words. Nothing. Firm B guesses the document's ID. Not found. Firm B slips a tenant ID into its filters. Security error. Those tests keep running in production. A config change can break isolation after a deploy.

The requirement wasn't low leakage. It was zero. So isolation is layered, tested, and a single attempt pages someone.

Full breakdown in the lecture.