The commenting seems a little verbose here as the code does not seem that complex. I think a docstring giving the high level overview (such as details like "A backend can raise `PermissionDenied` to short-circuit permission checking"  would be sufficient). What do you think?