lookup returns all resources that has a particular permission for a specific user/group