Is nested permission checks not allowed in just the playground or also in spicedb itself?