```auth.has_access``` knows about the hierarchy of permissions.