In fact, wondering if this could be avoided, allow the ResourceAccessManager to return null to the filter, and in that case, build this function inside the SecureCatalog. Just an idea.