same goes for change on 'container': if its relationship is container:sub#hidden@container:parent only direct+indirect owners of "parent" should have can_read to the "container:sub" and its descendants - but not 'editors' or 'viewers' of container:parent