`resourceTenantAlias` and `resourceVisibility` were only separated in order to separate the knowledge of the resource model from the low-level authz api. Now that we're starting to introduce  full principal objects, we can probably just take in a resource here as well. This doesn't need to be done in this PR though, let me know and I can create a new issue to refactor that a bit.

After a bit of API design work, the old "AuthzAPI" as we knew it can probably become a "DAO", and we can build more centralized high-level permission checks utilizing both visibility and joinability in mind for the API. I think we'll need to explore Collections permissions requirements a bit more first before we can make something flexible enough, though.