In authzed.com our tenancy layer has access tokens with specific roles