to add to 1, i've found that it helps when modeling to think of a permission check as being a walk from the resource to the subject, not the other way around