we've had a number of requests for "give me all permissions a user has", but computing that add significant overhead (theoretically)