Separate Qdrant collections provide simple per-repository write credentials, but Qdrant queries target one collection. For homogeneous repositories, I would instead test one collection partitioned by repository; Qdrant supports collection-scoped credentials if strict collection isolation wins.