in general we try to look for O(1) relationship creations for permissions driven API actions as a sign that the schema is optimal/normalized