Tableau Cloud and Bridge - Live vs Extract Security With Multiple Sites

Question

My company wants to set up multiple Tableau sites under Tableau Cloud Manager for different on-premise databases in different locations. Each site will have a bridge client set up to only hit their database and each site will generally have separate user groups that don't belong to multiple sites. However some users may have access to multiple sites.

The security team is concerned if someone who belongs to multiple sites can accidently publish something onto one site data using data from another site and exposing it to people who normally wouldn't have access. I believe this would mean that the user would have to be accidently logged into the wrong site before publishing but that doesn't seem to be outside of the realms of possibilities. Also, I think that that if someone published something in the wrong place, the bridge clients will prevent the data from being loaded on Tableau Cloud because the site bridge will only have access to it's appropriate database.

I'm sure this will work for live connections but I'm not sure about extracts. Will a published extract be visible if someone published the data into the wrong place? I'm sure that the extract refreshes would fail but I don't know if Bridge does any communication to the database server for extracts.