It handles object-level permissions. We mainly use it to control the `projects.can_run_commands` permission, which determines if a single user has permission to run commands for a single project.