> [update] it seems: permission can be looked up with LookUpResource and LookupSubject. which are streaming RPC. those are not the same as a check, however