generally if you're expanding that many IDs, you'd do the filtering on your side first and then check if the user has access