super basic grant, revoke, set and checking in place. In memory only. No tree walking of resource trees