If you implemented Tenant Restrictions v1 and only validated Restrict-Access-To-Tenants, you may only have implemented half the control you think you have.