For a pair, you could use CheckBulkPermissions to get all the permissions that user has on that resource. If you already have the list of resources you want to check ahead of time, that can also be handled with CheckBulkPermissions. https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.PermissionsService.CheckBulkPermissions Searching for every possible resource and listing every permission on those resources seems intensive, not sure if others have better ideas there.