if you don't mind having extra rows lying around, you can elide the rollback and just always filter by permission: if the item can't be accessed, its invisible to the user