Keeping three tenants apart is table stakes. What is hard is the person who belongs to two of them, the consultant who works across all of them, and the auditor who belongs to none — without any of them becoming a hole in the wall. Pick a person and a file.
three tenants, four kinds of access
grouped by the tenant that owns it
pick a person and a file
tenant, team, project, file
Isolation is structural, not a filter. A file reaches its tenant only through its project. There is no path from one tenant's admin to another tenant's file, so isolation is not something a query has to remember to apply.
An exception is one relationship, not a new role. Alice is an admin of Acme and an external collaborator on one Bright project. Both are true at once, and neither leaks into the other.
Revoking is one delete. Remove the external collaborator row and the access ends — no role to unpick, nothing left behind in another tenant.
This runs a real evaluation in your browser against the schema and relationships shown, so the answers and the paths are computed rather than scripted. It covers a subset of the SpiceDB schema language and is not a performance demonstration. The tenants and files are invented.