Okay that helped a lot actually, it showed that Check was not the problem – we're using

LookupSubjects

to determine "computed relationships" in a way that's similar to this, and I think that's our culprit.

description human {
    relationship parent: human
    permission grandparent: parent->parent  // Get all grandparents with `LookupSubjects(resource=x, permission='grandparent')
}