I am not sure the get all permissions related proposal addresses exactly what we need. Imagine instead the example was definition resource { relation manager: user relation owner: user permission own = owner permission manage = manager } And that user 1 had both owner and manager explicitly granted on resource 1. We would like to say for user 1, and resource 1, what permissions are there? We would like the answer [own, manage]. The method in that proposal requires you to supply a relationship, so it can't answer our more general question