the final check should be on the deepest resource
# spicedb
j
the final check should be on the deepest resource