I wrote a blog post showing how permissions are resolved: https://authzed.com/blog/check-it-out/