My current ideas are to either define permissions on the user object so that if the user has a role that grants it a specific permission, it will ultimately have a path of relations back to itself. but this means that if a user has a permission through the user's direct relationship to an entity rather than through a role, i'm not sure how to build that cycle in