gotcha. yeah, if the UI you're driving is explicitly a tree, then what you're doing is how i'd do it. the only other thing i can think of that might be worth exploring is https://buf.build/authzed/api/docs/main:authzed.api.v1#authzed.api.v1.CheckDebugTrace, which is something that you can request on a

CheckBulkPermissions

call. you could use an LR to get the list of accessible groups, then make a

CheckBulk

call with the debug flag enabled and get back the recursive representation. that is an expensive operation, though.