How do you keep departments or subsidiaries genuinely separate?

Serving distinct constituencies from one platform raises a specific risk: not that one population deliberately sees another's content, but that retrieval assembles fragments across a boundary nobody realized was porous. Separation enforced by filtering depends on every query path respecting it.

Audience assignment in Centralpoint is a property of records evaluated during retrieval, and material outside a population's surface was never embedded into it. The boundary is describable per population rather than dependent on filter behaviour, which is the form a tenant or a subsidiary asks to see during due diligence.