but yeah: the high level is we have an API (LookupResources) for retrieving the list of resources on which a subject has a permission; today it isn't paginated (but will be soon), but it won't scale past a certain point