@lifagui - depending on your specific isolation requirements, you could explore a couple of options:

1. Model your authz graph such that each tenant has its own disjoint warrants. Everything exists in the same authz graph/instance but data is logically separated and not related between tenants.
2. If physical isolation of data between tenants is required, you'll likely need to run multiple instances of the warrant service, one for each tenant.