Answer
Use AppProjects to restrict which clusters/namespaces each tenant can target, RBAC to scope who can act, and possibly dedicated clusters per sensitive tenant. Network policies and separate credentials further isolate. This limits both accidental and malicious cross-tenant impact in a shared control plane.
Real-world example A regulated tenant is confined by its project to its own cluster and namespaces, unable to deploy elsewhere.