the only scenario where adding a new relation could result in a loss of permission is if you use an exclusion, ala: