Permission system is inferred from the referenced object types in the request