I have a similar use case.. to perform a certain operation, we need to get the list of all permissions (not relations) that is granted to each subject on a resource. The way I did this for now is calling Authzed n times, n being the number of valid permissions on a resource, for each running a LookupSubjects filtering by that permission. Alternatively, if looking for a specific subject and not all, I replace LookupSubjects for CheckPermission requests. Obviously this isn't ideal, as I'd prefer to achieve these in a single request. Any better ideas?