if the permissions used by all tenants are basical...
# spicedb
j
if the permissions used by all tenants are basically the same, option 1 is the way to go