@timwis you can run a permission query in a model and relationship level