I have following use-case. User has Groups like G1, G2 in Application A R1 (Resource) has viewer relationship with G1 R1 (Resource) has writer relationship with G2 Inside application code before rendering edit button, need to check if user (based on group) has write permission. I will have to make 2 calls for permission check 1 for G1 and 2nd for G2? If user has N groups, this becomes N calls. Because we don't have direct relationship with resource and user, we have only resource to group relationship.