Should this query include a permission check? (e.g. readable(current_organization)