The other types are actually checking permissions internally to the model by passing in the user object. Internally, they are calling `filterResultsByPermission`. I added [some comments as a TODO](https://github.com/girder/girder/blob/metadata/girder/models/item.py#L147-L155) about how this should be implemented for item, since it's a special case.