How do you implement multi-tenancy or data isolation in ChromaDB?

import chromadb

client = chromadb.PersistentClient(path="./multi_tenant")

# --- Strategy 1: Separate collection per tenant ---
# Strong isolation — one tenant cannot accidentally access another's data
def get_tenant_collection(tenant_id: str):
    collection_name = f"tenant_{tenant_id}"  # e.g. "tenant_acme_corp"
    return client.get_or_create_collection(
        name=collection_name,
        metadata={"hnsw:space": "cosine", "tenant": tenant_id},
    )

col_acme  = get_tenant_collection("acme_corp")
col_globex = get_tenant_collection("globex_inc")

col_acme.add(
    documents=["ACME internal policy v1"],
    ids=["acme-doc-1"],
)
col_globex.add(
    documents=["Globex product catalogue"],
    ids=["globex-doc-1"],
)
# ACME queries can never return Globex data — total isolation

# --- Strategy 2: Metadata filtering (shared collection) ---
# Lighter weight — all tenants share one collection, filtered at query time
shared_col = client.get_or_create_collection("shared_docs")

shared_col.add(
    documents=["ACME policy", "Globex catalogue"],
    metadatas=[{"tenant_id": "acme"}, {"tenant_id": "globex"}],
    ids=["s1", "s2"],
)

def tenant_query(tenant_id: str, query: str, n: int = 3):
    return shared_col.query(
        query_texts=[query],
        n_results=n,
        where={"tenant_id": tenant_id},  # ALWAYS filter by tenant
    )

results = tenant_query("acme", "company policies")
print(results["documents"])  # Only ACME docs returned