@Joey to add to what we discussed above -- things ended up being quite elegant as I only needed one call per permission for all of the resources. That's great because it's finite, vs the inverse that is bound by the user and not us. again thx for the assist!