they don't tend to provide hooks where you can say "call this endpoint to determine whether a user can do a thing"