would you consider this a (the?) downside of using ReBAC system vs a policy engine where app data is colocated with permissions data?