// The bad thing, as a policy set: it allows exactly the requests whose tool belongs
// to another tenant than the one bound at authentication. If the real set and this
// one never allow the same request, no cross-tenant call is ever permitted.
@id("cross-tenant")
permit (principal, action, resource)
when { resource.tenant != context.tenant };