Add view-permission check for referenced objects