Plumbed me.tenant_id through api.ping + loginAs into the store as tenantId. Approvals.loadQueue filters /api/ea2/work-items by tenant_id matching the signed-in user so the queue only shows actionable rows. Probe of EA2 work-items returned 73/80 in canvas's tenant (a0000000-...), 6 in hms_dev, 1 in hub-cnt-f56ce0 -- those 7 are now hidden.