This module controls how each permission individually reacts to an access.
Although these functions take protected as an argument, this is NOT because
we check protector violations here, but because some permissions behave differently
when protected.