Access is resolved,
never assumed.

Your session is bound to an active tenant membership and a role before any graph data or action is returned. The boundary is enforced in the query, not the view.