If a permission hasn't been checked before (and thus is missing from the cache), will it be evaluted at the current snapshot, or will it simply be denied?