Formalises the "relevance-authorization gap": retrieval ranks by similarity, not entitlement, so one tenant's query can surface another tenant's confidential data simply because it scores highest. Their fix is layered, policy-aware ingestion plus server-side enforcement of tool execution and state isolation, with an open-source reference implementation. This is the b2b2c problem stated precisely: in a shared index, semantic relevance is not permission.