please see what `assert()` does. it retrieves the assertion from the permission and runs it, if it exists. since it's protected, it's not part of the API and therefore should not be a problem.