Simple, explicit permission checks and row-level query scopes constraining what data a user can access