or in short: if any container/asset has a 'hidden' relationship in the hierarchy, only owners/parents-owners of that branch shall have 'can_read'