Add notes re view-level and instance-level permissions checks. Closes #1819.