The INTERNAL upcall stores the supplementary group list in an MDT-wide, in-memory cache. This helps limiting the performance impact, however, the same cache will be used for all clients. If a client is not trustworthy or is misconfigured then it can cause incorrect group data to be cached on the MDT, affecting all clients using that MDT.

So the use of the INTERNAL upcall should be limited to clients that are known for doing metadata intensive operations while using a large number of supplementary groups or ACLs.

Rather than limiting the use of INTERNAL to only particular clients/tenants, would the task here be to split the MDT-wide cache into a per-nodemap cache.