Also you should be checking `Run.ARTIFACTS`, if `Functions.isArtifactsPermissionEnabled()`. Cf. `Run.doArtifact`. Note that `ARTIFACTS` is scoped to `Run` not `Item` so you would need to check this after computing `src`, not as part of `canReadFrom`.