Since the route is scoped on repository, the permission system should deny access if the user doesn't have access to the resource defined by this permission. That being said, I can test/add it if you wish.