the gateway restricts every query to the caller's tenant column