Once identity is verified (authentication) and it is verified that that identity actually has access to a tenant (authorization), it needs to be ensured, that a query is truly limited to the set of data belonging to a tenant.

The strategy for this is the same as prom-label-proxy, but should be tightly encoded into the Observatorium API gateway for easy consumption and setup.