We should fully hydrate the object before we try to perform any authorization checks