What is 'this' ? We can only use one permission to 'guard' the route/controller, but can use inner controller logic to apply authorization to the "filters" (e.g. content view, environment)