encapsulate queries to CrudPermissions
method to manipulate a query for owned objects.
get_target_class method on TraversalContext
extract a permission check method, and use query restrictions