The resolved tenant, populated by the multi-tenancy middleware. Absent when no tenant could be resolved or multi-tenancy is not enabled.

It accepts one implicit write per request; use replaceTenant for an intentional replacement. Like user, this detects late accidental overwrites and is not an authorization control.