I've always wondered: what happens when we get to an ancestor that has permissions that don't explicitly grant the session the privileges they are looking for (e.g., write)? Shouldn't we continue up the ancestors looking for privileges that grant the privilege we want (e.g., write)?