Ok. So I guess the best way to go about it then would be to get a list of all resources owned by foo, then make a check permissions request for each resource to see if bar can view. Is that right?