Pull the tenant from the auth context, not the request body

In multi-tenant apps, a common bug is reading tenant_id from the JSON body or query string and then authorizing against that value.

Anyone can send tenant_id=other-customer. The tenant for an authorization check must come from the authenticated principal or server-side session — the same place you already trust for user identity — not from client-supplied fields.

Pattern:

1. Authenticate the caller.
2. Resolve their tenant (or list of tenants) from the token/session/membership store.
3. Authorize the action for that tenant and resource.
4. Ignore or reject a client-supplied tenant that does not match the resolved one.

Treat client tenant_id as a filter preference at most, never as proof of tenancy.