Rolify and acts_as_tenant with Single Signon (with some Devise & Pundit on the side) - can it be done?

I am going to try and make this work in my Rails app but I figured I would see if anyone knew of a gotcha that would stop me in the tracks.

The basic premise is that I have the following models:

• Company - the tenants in acts_as_tenant
• User - unique email addresses shared across all tenants tied to Devise for authentication i.e. single signon
• Role - via Rolify and then use Pundit for authorization
• Model1, Model2 etc. with each record belonging to a single Company

From what I have read so far as long as I set this up right I will have my tenant data segregated and then users can switch between tenants and their permissions will change accordingly.

So my specific question:

Will acts_as_tenant just work with the Rolify?

So for example if and admin user in Tenant1 adds a role to a new user will that role automatically only apply to the resources owned by that tenant?

I ended up with the apartment gem and my User and Company models in the public schema. I have a Role model that links User to Company and contains the Roles that the user has for a given company. Devise authenticates the User and Pundit uses Role to authorize.