That was the whole point of this, wasn't it? The user not passing the assertion but just passing the permission and the context