yes the lookup does Authzed prefiltering, then you would pass those IDs into a database query, maybe padded out enough so that you're likely to get a full page after DB post-filtering, you can also do you criteria in the DB and then pass each item to an authzed check for post-filtering