currently you'd do that by writing an object type that was a "tenanteduser" or some equivalent and issue a check for that subject