not an expert but maybe you can use a combination of CheckBulkPermissions to store a state of your permissions each time after some changes are recorded in relationships and with WatchAPI to track changes of the user's relationships