I think it might be better to check $auth->acl_get('f_read', $forum_id) in the topic_review function, less likely that someone will use topic_review somewhere else and accidently get around the permissions.