LangChain Enterprise RBAC (Python) Overview A B2B SaaS team shipped their first RAG feature for two tenants. The factory code looked innocent: build once at module import with (the first tenant), convert it to a retriever, store it in a module global, reuse on every request. Six weeks later tenant "Initech" went live. Their first search returned three documents from Acme Corp. The singleton retriever had captured the Acme namespace at process start. was being passed in — but the retriever never read it, because the filter was baked in. Every request for every tenant hit the same Pinecone name…