one is to call

LookupResources

to get the list of things the user is allowed to see and then feed it as a

where id = any([<stuff>])

query in your rdbms