I think the worry I had with per-item request that is that it feels like it would break pagination - you're going to the database for a specific page of data, then permissions may filter some of that page out which would leave you with less than a page to show. Plus, page info about total count/remaining items would also not necessarily be factual for the specific user.