LUN-1234: allow apps to use their own perms checks