for the former we've got logic in our wrapping application to manually walk the graph and return all of the "accesses," which is what we're calling a role + resource pair