Thanks @kartikay. I like the idea of storing snapshots and using the WatchAPI to track changes. I'll have a think on those. However, to call the CheckBulkPermissions API you need to know the permissions ahead of time. I was just hoping that I could interrogate the schema to return all permissions for a given relationship and resource type.