I see, so by having global ID I can achieve both use cases E.g user has permission to manage only one document User has permission to manage any document In this case I have to create two permissions