Goal: 

• The query endpoint enforces tenancy correctly based on policies
• 2 levels of privilege are recognized (elevated privelege user ( admin by default) has full access, while less privileged users have restricted access  - only to metrics in their current project)
• Code comes with tests

Acceptance Criteria:

• A patch with the functionality is proposed.