how are you calling Keto to check the permissions decisions?