you give it a user and a permission, and it returns all resources that user has that permission to access