they are unidirectional for all APIs except

LookupResources

, which allows for a reverse walk to find all resources for a particular permission + subject