a third option, if you want true isolation, would ...
# spicedb
j
a third option, if you want true isolation, would be to run a SpiceDB cluster per tenant