by default, the consistency is "best effort": i.e. caching is used. If you don't send back a ZedToken, and you don't change the consistency level, then there will be a period of time where the cache is used to compute a permission response vs going to the datastore