Filtered vector search

Design filtered vector search for a multi-tenant SaaS where every nearest-neighbor query must be constrained by metadata predicates (tenant_id, access-control labels, document type, date range) and the filter selectivity varies wildly, sometimes it passes 90% of vectors, sometimes 0.001%. The naive approaches both break: post-filtering an ANN result can return too few rows when the filter is selective, and brute-force pre-filtering is too slow when the filter is broad. Walk through how you make filtered ANN both correct and fast across that selectivity range, and how you enforce the tenant/ACL filter so it can never be bypassed.