so its not really an LR "through" the org, because...
# spicedb
j
so its not really an LR "through" the org, because the user could have direct access