So, if I have to get all resources where at least one of the members of a group has own permission, the only way is to cycle through all members of a group and do a lookup on them?