AT:

• the authorization information fetched from an engine includes tenant information if present
• the optional defaultTenantId configuration is applied to the authorizations fetched from each engine, a user with application permission is also granted access to default tenants
• on listing process/decision definitions a user only sees the definitions for tenants he is authorized to https://github.com/camunda/camunda-optimize/wiki/Process-Definition#get-process-definition-available-versions--tenants-grouped-by-key as well as only the tenants he is authorized to see
• a user can only evaluate a report for which he is authorized to access all set tenants on data.tenantIds