you either call

LookupResources

to get the entire set of objects that a user can see and use that as a

WHERE id = ANY()

clause or you overfetch a page from the DB and filter it using

BulkCheckPermission

to the objects the user can see (maybe doing this multiple times if you need to fill a page)