and you can either do it that way with a

LookupResources

first and then filtering the DB call, or you can overfetch a DB page and then use

BulkCheckPermission

to figure out which of those records should be returned