DataNucleus does standard multitenancy, as defined in the docs. A user is running the PMF/EMF and so on creation of a record the record is tagged against that user. Read is for data for that user ... an exact match.

The only difference (extension) to that is what is in this issue regarding datanucleus.TenantReadIds.

Require anything else means you get the code ...