there's also some batching behavior under the covers where it will group related permission checks and turn them into a single datastore request