when you say "listing all permissions a given user may have," do you mean on a given resource or on any resource?