admit
Whether caller may name target and the tenants it reads at all, whatever it reads: only a caller that may act across scopes names either, and the tenants only while cross-tenant queries are on. Throws the QueryErrors.FORBIDDEN QueryError that refuses it.