issue #18861: compound privilege checking