Expand returns the list of direct subjects with access to a particular resource+permission; you could, in theory, store that alongside a resource, update it via Watch (with sufficient domain knowledge of the schema), and then use a modified LR to find the list of subjects reachable for the current user to do an intersection... but its a difficult solution to get correct and would require support within whatever system you're filtering