This is the query that does heavy lifting for access control.  It either uses the members field for the current user, or calls legacy behavior.  It then allows scopes defined for the user to limit the request further.  For example, only the Session scope has access to the Authorization resource - all other scopes will set 1=0 as a query parameter which means no authorizations will be returned.  This in turns means lookups are either empty, or 404 (where vs. find)