even when I hammer on it with permission checks, those metrics never seem to tick