ensured permission and depth constraints are enforced

turns out an additional AuthZ check is *not* required since we're
already constraining the scope