How to correctly scope multi-tenant queries so public content is always visible alongside tenant-private content