what kind of multi-tenancy are you looking for? strict isolation between permissions systems? or some kind of federation over reads and writes in a single global permissions system?