Other question, posting separately to make clean, is that if it is possible to sort out permission check if there is more context than just resource and principal to sort out the decision? Like if some assignments are present eg in the third entity?