so the permission should be granted to 1-n direct assignee's... but if there are none, and only in that case, it should go to the parent?