Whatever you land on, make the privileged paths countable and noisy, because the failure mode here is not a dramatic breach, it is quiet accumulation.
What happens otherwise: someone hits a policy that is inconvenient at 6pm, reaches for the bypass client because it is there and it works, and ships. Nobody reviews it as a security decision because it does not look like one. Two years later there are nineteen of those and no list.
Things that help:
Keep the privileged client in exactly one module with a name nobody can use accidentally, and make importing it visible in review. If it is easier to import than the normal client, it will be imported.
Log every use with the operation and the caller. Then you can answer "what actually uses this" from data rather than from memory, and the list is nearly always longer than expected.
Write a test that fails when a new bypass appears. A grep in CI counting occurrences against an expected number is crude and it works - it turns adding one into a deliberate act with a number to update.
And on the current situation: before refactoring, list what those three services actually do with the connection. In my experience two of the three turn out to need one table each, and only the aggregation genuinely spans tenants. That makes this a much smaller job than it looks.