Definitely it is not the job of an access check to also check implied-by permissions; this is supposed to be handled by the authorization strategy. Maybe because the permission you define is implied by `Permission.READ` rather than `Item.READ`?