Right now, that needs to be supported for several reasons. We feel the organization that hosts the environment would want some control over whether or not cross org sharing is allowed, and we do not have cross-organization trust or policy at the moment. That organization should be able to choose whether they want to lose visibility into the dependency graph, detailed audits, and whatever transitive trust the user could set up. For a number of our customers this would be a hard requirement to not allow this sort of trust.