I know you documented this in the Hilary PR but just to double check, is there absolutely no difference between `_network` and `_tenant` if the tenant is set to private? If there are subtle differences we probably need to do a check here to decided which one to use.