docs: def get_queryset(self, request):
          """Limit to TenantGroups that this user can access."""
          qs = super(TenantGroupAdmin, self).get_queryset(request)
          if not request.user.is_superuser:
              qs = qs.filter(tenantrole__user=request.user,
                             tenantrole__role=TenantRole.ROLE_GROUP_MANAGER)
          return qs