In Hibernate how to achieve tenant filter on OneToMany Field for example assume

@Entity
@Table(name = "\"user\"")
class User(
  @Column(nullable = false)
  @Id
  @GeneratedValue(strategy = GenerationType.UUID)
  var id: String? = null,

  @Column(nullable = false, unique = true)
  var userName: String,

  @Column(nullable = false)
  var email: String,

  @Column(nullable = false, updatable = false)
  @CreationTimestamp
  var createdAt: Instant? = null,

  @Column(nullable = false)
  @UpdateTimestamp
  var updatedAt: Instant? = null,

  @OneToMany(mappedBy = "user", fetch = FetchType.EAGER, cascade = [CascadeType.ALL], orphanRemoval = true)
  var userRoles: MutableList<UserRole> = mutableListOf(),
)

@Entity
class UserRole(
  @Column(nullable = false)
  @Id
  @GeneratedValue(strategy = GenerationType.UUID)
  var id: String? = null,

  @ManyToOne
  @JoinColumn(name = "user_id", nullable = false)
  var user: User,

  @ManyToOne
  @JoinColumn(name = "role_id", nullable = false)
  var role: Role,

  @TenantId
  @Column(name = "organization_id", nullable = false)
  var organizationId: String? = null,

  @Column(nullable = false, updatable = false)
  @CreationTimestamp
  var createdAt: Instant? = null,

  @Column(nullable = false)
  @UpdateTimestamp
  var updatedAt: Instant? = null,
)

@Entity
class Role(
  @Column(nullable = false)
  @Id
  @GeneratedValue(strategy = GenerationType.UUID)
  var id: String? = null,

  @Column(nullable = false, unique = true)
  var role: String,

  @Column(nullable = false)
  var description: String,

  @Column(nullable = false, updatable = false)
  @CreationTimestamp
  var createdAt: Instant? = null,

  @Column(nullable = false)
  @UpdateTimestamp
  var updatedAt: Instant? = null,

  @OneToMany(mappedBy = "role", fetch = FetchType.EAGER, cascade = [CascadeType.ALL], orphanRemoval = true)
  var rolePrivilege: MutableList<RolePrivilege> = mutableListOf(),
)

In above it returns all userRole for user regardless of organization id when I do findByEmail, if i do findAll on UserRoleRepository it works for specific tenant id.