Companion

What the scope policy lets the caller read: a platform-level dataset is seen by the callers of its tenant only (and by a cross-tenant caller that reads it), since any other tenant's queries of it match nothing; and a caller whose principal sets an owner or a space sees only the datasets with that column, since its queries of any other fail closed (UNKNOWN_FIELD). Every query of a dataset the caller sees is restricted to its tenant, owner and space.