Add permission check for referenced objects