Which would limit the scope of the "moderator" role explicitly to the tenant database.
Eg. https://martendb.io/documentation/documents/tenancy/
Fyi: The op, which i was responding too, was referring to using roles as const. Which is not dynamic :)