If this is to avoid loading all the principals in `resolveTenantBoundaryViolations` unnecessarily, maybe we can do the AuthzAPI checks before the target user violations checks.