so I got this working, but tbh I'm a bit confused why it works. we're checking for permissions, when member and manager are relations. why does this work?