as in all of the information required to compute a permission is available at request time without looking at anything other than the object that you'd be returning?