Restricted-identity checks

Sign in as the identity you want to prove, then run: configuration and repair writes should be denied, core work should stay available, and no tenant should see another tenant's records.