Sub-ticket of ENAMEL-28 Shared support tables have zero DB-side access control: no RLS, owning role, cross-tenant with terra · enamel