Would Kratos support something like a multi-tenant environment? User logs in, gets asked to which env he's giving access. Token would have to contain additional claim with the env_id or maybe introspection could check it.

Yes, you can deploy multiple Ory Kratos per tenant, see more here: https://www.ory.sh/docs/kratos/guides/multi-tenancy-multitenant Works the same selfhosted or in Ory Cloud