the second is to get a page (ideally bigger than the page you would return to the client) from the DB and then call

BulkCheckPermission

on those IDs to filter