Why a request with no access or permission rule is denied, not allowed.
Why we create tenant partitions on first request, not at startup.
Why we invalidate by bumping a counter, not by scanning for keys.