@User I'll wait for your assertions to know for sure, but I suspect if you can decorate the applications with their attributes, you can do a check like:

application:1 can (whatever) application:2