I think I see. What does this generally look like in practice for most people with hundreds of object types. While I get the flexibility it seems like an awful lot of redundancy. To make this more realistic, I'd imagine both folder and team in this example would require a permission more like "can_view_documents" since a "team" probably "can view" many things and needs context. And then the document permission called "can_view" must check if those relations "can view documents". Then multiply that by potentially hundreds of types of objects. Makes it seem like the definition for "team" ends up with a bit of a bloated superset of all permissions to all things it could be related to. And the things it's related to then needs to have it's subset of permissions that crawls back to the Team permission (and folder in this case). Is that typically how it works out for most people? And that doesn't create a different sort of maintainability problem? Sorry, I'm not trying to criticize. I'm trying to get a realistic picture. The sheer volume of permissions to follow this practice has me a little concerned.