and you still need the permissions in the role if you do it your way, i.e. you still need to do the intersection