@arekkas +1 for _not_ passing an additional assertion to `isGranted()`.
I can't see why we still should need it. If `'permission'` isn't sufficient to complete the check (thus needing an additional assertion), the `'permission'`'s mapped assertion must be extended with the additional assertion's functionality, using `'$context'` for deciding when to apply the "addtional assertion". Phew, was that weird?
Finally, for me, an $additionalAssertion would make things more complicated - in usage and in underlying implementation -, and opens paths for doing dirty things beside the (otherwise) clean api...