and rather than each caller needing to setup the full context for permissions checking, it would just be a simple

check

call to the central SpiceDB