hm, but this schema would expose the "asset:hidden-2" to "user:sam" because she has "can_read" relationship on the top-most container