SENTRY-342: grant check with grant option