Yep, I agree, other option is to use a threadlocal to pass additional roles down the call stack, but this means lots of threadlocal work as there would be an authz lookup for each item in a resources view.