Question, when in the request pipeline are permission queries executed?