Silo, Pool, and Bridge for Multi-Tenant RAG: Measuring Isolation, Noisy-Neighbor Effects, and Cost in SaaS Microservices

Multi-tenant Retrieval-Augmented Generation (RAG) enables enterprise SaaS platforms to ground large language model outputs in customer-specific data while sharing infrastructure across tenants. This deployment model introduces a hard requirement for strict tenant isolation across storage, embedding generation, vector indexing, retrieval orchestration, and response construction, without unacceptable cost or performance variance under mixed workloads. This paper formalizes three isolation patterns for multi-tenant RAG systems, Silo, Pool, and Bridge, and introduces an isolation taxonomy across four planes: data plane, vector plane, orchestration plane, and LLM plane. A threat model specific to multi-tenant RAG is presented, covering cross-tenant embedding leakage through similarity search, membership inference risk, retrieval contamination from incorrect scoping or poisoned content, and metadata inference. A Kubernetes-native reference architecture is specified to implement tenant-aware controls and explicit policy enforcement points across ingestion and retrieval. The paper also defines an evaluation approach for comparing isolation patterns using leakage testing under adversarial retrieval scenarios, mixed-tenant latency measurements (P50 and P95) to quantify noisy-neighbor effects, cost-per-query decomposition, and operational overhead.