We have been considering the same, as we also have the case of additive permissions across entities grouping users/resources. As there wont be too many cases like that per user though, we are planning to make use of bulk checks of permissions.