As mentioned by Lucas (from this PR https://github.com/observatorium/api/pull/191)

"Note: this is a distinct problem from ensuring that the rules written by
a tenant are guaranteed to only include data from that tenant.
Currently, the rules from a tenant can select data from any tenant. This
is a distinct problem and should absolutely be tackled in a follow up."

A/C

• Tenant rules can't query data from other tenants