I don't completely understand why

>If Role A has permission "foo" and is children of role B, I expect $roleB->hasPermission('foo') to return true. If I move the recursion logic to Rbac, I will have false.

would fail? Couldn't the container iterate through the role's children just like the role itself does?