I'm naive enough to wish for "all", but what I'm missing is best practice for watching for and then reacting to a change with transitive effects, like adding a user to a team which then gives them permission on a lot of objects