CheckBulk with a zedtoken per permission will effectively be unoptimizable since we can't share any of the work