also, in that example

permission p = x - y

, you don' need to compute the full set of relations

x

, right? Just that at least one exists?