LookupResources is a reverse graph walk: it starts at the specific user (and

user:*

if allowed) and follows any incoming relationships until it reaches the resource for which the call is being made