Use keys-only queries where possible in PALPermissions