I chose to do this resolve immediately before the permissions load which could be debatable.  I toyed with putting it after the TargetModel.permissable check below but ultimately decided that internal requests would probably always just want to resolve immediately in lieu of having to alter all the permissable functions to also add this check and just resolve.