Figure out a way to give users access to their logs with Loki

It would be nice to be able to let users read logs, but only for containers in their namespaces. Loki doesn't seem to have per-stream access control.

Perhaps a proxy can be implemented?

Or perhaps the multi-tenancy support in Loki and promtail can be leveraged? It doesn't look very capable.