The $tenant parameter is currently only allowed by the __system.local user. It should be allowed by a user with lesser privileges, though still broad. We'll create a new ActionType applied to cluster resources that will have lesser privileges than the __system.local user, but still allow use of $tenant.