then you can check synthetic relations that refer ...
# spicedb
y
then you can check synthetic relations that refer to each permission individually, or you can check the runtime permission that gives you the overall answer