you'd have the FE issue a single call to BE, which makes a bulk call over the different permissions