To answer the question towards the end of the stream about customising permissions within tenants (which I was totally unable to process because I was wrestling with my

exists

-ential crisis): This is a great use case for scoped policies, where each tenant can have its own scope, so that policies defined within that scope only apply to that tenant. There's also something in the works to make it easier to define those custom per-tenant roles and even to allow end users to define the roles within their own tenant. It's a big topic though - one for a future livestream, I reckon @Daniel Maher!