Paper over a crack in the permissions system pending a thorough
refactoring of permissions-determining functionality. Previously,
if an item had a given permission scope, and the user's permission
grant was ALSO scoped to something in the item's scope, BUT the
action was not performed within the given scope, the action would
not be allowed. Obvs. this logic is complicated, but it really
shouldn't be. Permission scopes at the object level should always
apply only to global operations. On the item level, the item's scope
is what we need to check. This should be coded in a clearer manner.