it had everything you talked about plus more things like guiding you not to do a permission check if your subject type wasn't in the transitive closure of types that your starting resource could be associated with