Is there an efficient way to answer the question "Does a user have this permission on at least one resource?" I could do it with lookup-resources, but that'd be very expensive. Trying to figure out the best way to show/hide top level navigation items.