i don't expect permissions to change frequently, so eg. rollback to the zookie - er zedtoken - if there are no subsequent changes