complete permission checking logic, and make it cachable.