Where i'm stuck is, do we need to build an engine that takes in an application identity, and then expands that into a sequence of CheckPermissions for each attribute we need to check.