1. I do load all the roles when viewing a folder listing for each file in the folder. So that we can come up with a sensible way to describe the role based access. I don't think we could do this with an authz check without knowing beforehand which roles to check. We could iterate through the `availableRoles` as they are configured with authz checks though. That would work nicely.
2. I am and I'm not surprised by the design. I'm not surprised that we have a monolithic object doing everything. I am surprised because in other areas of the code we make distinctions between `Entity` and `Edit`. The point is the ListItem populates all of the metadata associated with an entity (and sometimes inconsistently between its 3 constructors), but for a majority of tasks that is overkill. Am I speaking sense?