sparkle: basic authorization rules based on tenant