Limit tenant checks to multi-doc actions

src/integrationTest/java/org/opensearch/security/privileges/int_tests/DashboardMultiTenancyIntTests.java

@@ -999,6 +999,27 @@ public void catIndices_withTenantHeader_shouldNotBeDenied() {
         }
     }
 
+    /**
+     * Verifies that the paginated list indices API is not denied when its internal monitor
+     * requests operate on a concrete page that includes dashboards tenant indices.
+     */
+    @Test
+    public void listIndices_withTenantHeader_shouldNotBeDenied() {
+        // Only run once (not for every parameterized user)
+        if (!user.equals(WILDCARD_TENANT_USER)) {
+            return;
+        }
+
+        try (TestRestClient restClient = cluster.getRestClient(WILDCARD_TENANT_USER)) {
+            TestRestClient.HttpResponse response = restClient.get(
+                "_list/indices/.kib*",
+                new BasicHeader("securitytenant", "human_resources")
+            );
+
+            assertThat(response, isOk());
+        }
+    }
+
     /**
      * Verifies that deliberately targeting another tenant's concrete index in a multi-document
      * request is denied. This is the cross-tenant protection that the interceptor provides:

src/main/java/org/opensearch/security/privileges/actionlevel/legacy/PrivilegesInterceptor.java

@@ -241,7 +241,10 @@ public ReplaceResult replaceDashboardsIndex(
             // We check originalRequested (what the user explicitly specified) rather than allIndices
             // (the fully resolved set) to avoid false positives from broad queries like _cat/indices
             // where tenant indices are incidentally included in the resolution.
-            if (!requestedResolved.isLocalAll()) {
+            if ((request instanceof BulkRequest
+                || request instanceof MultiGetRequest
+                || request instanceof MultiSearchRequest
+                || request instanceof MultiTermVectorsRequest) && !requestedResolved.isLocalAll()) {
                 final Set<String> originalRequested = requestedResolved.getOriginalRequested();
 
                 for (String idx : originalRequested) {