Optional tenant restriction. When present and non-empty, the flag is false for any context whose tenantId is not in this list — including a context with no tenant — and this restriction is evaluated ahead of every other rule (it is not an allowlist: it cannot be overridden by users). When absent, evaluation is unchanged.