i'd recommend treating

ReadRelationships

as an escape hatch, and it's definitely not something that should be in your primary authz check logic. i'm not sure i understand your use case from your schema. what's the plain-language business requirement? what do you mean when you say "connection to a list?" one thing is that it helps to think of a permission check as a walk from object to subject.