The one tenant caller reaches (reaches): its own; null for a caller that may act across scopes, which reaches every tenant. A read that a store filters by tenant takes it.
Whether caller reaches what is in tenantId, whatever tenant a type is fixed to: its own tenant, and every tenant for a caller that may act across scopes.