What risk does an application introduce if it forgets to include the tenant_id filter on a query in a shared multitenant collection?

The critical risk is cross-tenant data leakage: an unfiltered vector search can return semantically similar points belonging to another customer. Similar mistakes can affect scrolls, reads, updates, or deletes. Qdrant does not automatically infer the application's business tenant and silently add a tenant filter. Tenant isolation is therefore an application-layer authorization responsibility. In production I would centralize tenant-scoped repository methods, derive tenant_id from authenticated server-side context, and add cross-tenant isolation tests. A common misconception is that indexing tenant_id provides security; the index improves filtering efficiency but does not enforce authorization.