regardless i set tenant atribute in both resource and principal during request

I think it's because the condition should be

request.resource.attr.tenant == request.principal.attr.tenant

(you forgot the

attr

in

principal

)

oh god, tnk u, seems i need grab some coffee