and then the flow goes: 1. get a list of things that the user might be able to see using

LookupResources

1. use that list to filter the database results 1. issue a

BulkCheckPermission

call with consistency set to

at_least_as_fresh

with the token of the most recently updated item