Correct but if I wanted a user to be allowed to see all big query without creating a relationship to each bigquery resource then I would create a specific relationship on the tenant for that?