as an example, you might not want to have a

permission view = ...

on every single log message, but rather check if a user can view the log itself; this is usually the case when there won't be any "custom" or "direct" grants