`you don't want to expose` should be clearer that both tenant admins and end-users cannot see the value