You can only filter on what you declared

Why

Three of the four examples here are refusals, and each one is refused for a different reason. Try them in order. A vector index will only filter on attributes you nominated when you created it, and only with equals, and it says no immediately rather than quietly reading more rows.

You have met this shape before. A GSI makes you choose its key up front, and a Query that does not use that key cannot run against it. A vector index asks for more: the attribute it partitions by, and every attribute you might later want to filter on, all decided at creation and none of them addable afterwards.

Those choices live in the SearchSchema. At most one HASH, which is what scopes a search to one tenant here, and any number of INLINE_FILTERs. Every attribute you name has to appear in AttributeDefinitions too, which is the reverse of the rule for the vector attribute itself, so it is easy to get backwards.

The filters run inside the search rather than after it. That is the opposite of a FilterExpression on a Query, where you pay for every row read and then discard most of them. Narrowing a search costs you nothing extra.

One thing worth being blunt about: the HASH is not a security boundary. It decides where data sits and how throughput spreads across partitions, and that is all it does. Fine-grained access control does not apply to SearchVectors, so anyone permitted to search this index can read any tenant's incidents by changing one string in the request. Tenants that must genuinely be isolated need separate tables, or separate indexes with their own IAM grants.

And one failure you will not see coming: an item missing the attribute the SearchSchema uses as its HASH is written to the table successfully and left out of the index. No error, no warning, and it never turns up in a search. An item missing an INLINE_FILTER attribute is fine and stays indexed. The two behave differently and neither tells you.

Nominate your filterable attributes at index creation and use = on them; anything else is refused outright, and the HASH partitions data rather than securing it.