Hello and thank you for your answer but it does not really address the issue. The customer wants that given a user-name list all the permissions the user-name may have, it does not matter on what resources. I understood that the customer wants to give some permissions to a client for a given period of time an them after some time, remove them thus, it would be useful to know what permission a customer has (again, don't really care about on what resources )