Shouldn't we allow global admins to still override private config values for a given tenant? /cc @mrvisser