A multi-tenant assistant uses one knowledge store. Tenant metadata exists on documents, but the client supplies the filter value. What is the best isolation design?

1. Trust any tenant ID present in the user message.
2. Retrieve all tenants and ask the model to hide unauthorized facts.
3. Use encryption at rest as the only tenant authorization control.
4. Derive and enforce the allowed tenant filter server-side from authenticated identity before retrieval.