Tenant can be very high level, while this kind of access may be needed within tenant, like Organization -> department -> costcenter, what if I want list of costcenter with user's read permission within in a given department.