it is always safe to say "result == has_permission...