One block per tenant the token names, in claim order; unknown tenants skipped.

With X-B2M-Tenant (or ?tenant=) the answer is exactly that tenant's block, resolved like every other member endpoint (active_tenant) — which is how staff open the launcher as a tenant, audited as tenant.cross_access.

Staff viewing a tenant cross-tenant hold no seat there, so for them the block lists every app with a valid licence and launchable follows the licence alone. Everyone else — staff who are members included — needs an open seat.