one thing that you'll (eventually) run into is that for list endpoints, you'll need to choose whether to

LookupResources

and then make it do

WHERE id = ANY(<ids>)

- style logic, or whether to overfetch a page from your DB and then call

BulkCheckPermission

on each