expected rels computes the whole permissions system as if it were one (which, in prod, it s)