This is where something like OPA shines. Given a context, you can make an up-or-down decision as to whether or not the request is allowed. Then your not having to wedge security into your ORM reshape code.