I mean the resources are always owned by tenants so the check will be done in this context only for all permissions of the resource.