I have set up permissions for tenant specific users as follows:
Path = / with restrictions = */tenant
This structure has worked to provide tenant specific access in sites and assets, however, this format does not restrict the experience fragments and templates to the same tenant specificity. To troubleshoot, I've attempted to deny jcr:read to path = / with restrictions = */content/experience-fragments/* which does not work either.
I believe the URL for experience fragments including "/aem" is the problem:
Sites --> https://<url>/sites.html/content
Assets --> https://<url>/assets.html/content/dam
Experience Fragments --> https://<url>/aem/experience-fragments.html/content/experience-fragments
I'm also seeing the same inability for tenant restrictions in templates, but I need to do some more troubleshooting there since it's under /conf instead of /content.
Has anyone else attempted permissions in a multi tenant environment where each tenant only has access to their specific information?