Metadata filtering combines with vector search in two ways and the difference is not cosmetic. Post-filtering retrieves the top k by similarity and then discards those failing the filter, so a selective filter over a large corpus can leave almost nothing, and the query returns three results when the caller asked for ten. Pre-filtering restricts the candidate set first and then searches within it.
Approximate indexes make pre-filtering hard, because the graph or cluster structure was built over all vectors and walking it under a restriction degrades recall or gets slow. Different engines handle this differently, and some silently fall back to an exact scan over the filtered subset.
Read what your engine actually does before relying on filters for tenant isolation or access control. If correctness depends on the filter, enforce it in a separate exact query or at the storage layer, and treat a short result list as a signal to widen the search rather than as a genuine absence of matches.