My context: a single-instance multi-Tenant SaaS Web App, where each Tenant can have multiple Users.
We want to allow 3rd-party software providers (external Client
