A tenant is a container for one customer’s or team’s policy. Inside it, a VRF is a routing table, and a bridge domain is a Layer 2 flood domain, tied to a VRF, with subnets for its gateways. Nothing reaches a switch yet: a policy only lands where a host needs it.