expandpermissiontree shows all relations directly reachable from a permission; read takes in a single relation