What does this object-level authorization check print for the cross-tenant request?

const invoices = new Map([
  ["inv-a", { id: "inv-a", tenantId: "tenant-a" }],
  ["inv-b", { id: "inv-b", tenantId: "tenant-b" }],
]);

function readInvoice(principal, invoiceId) {
  if (!principal.scopes.includes("invoices:read")) {
    return { status: 403, body: "forbidden" };
  }
  const invoice = invoices.get(invoiceId);
  if (!invoice || invoice.tenantId !== principal.tenantId) {
    return { status: 404, body: "not found" };
  }
  return { status: 200, body: invoice.id };
}

const reader = { tenantId: "tenant-a", scopes: ["invoices:read"] };
const result = readInvoice(reader, "inv-b");
console.log(`${result.status} ${result.body}`);