Also, when we do permissions checks using creds, verify that we don't do so based on augmented creds, as extra safety check.