private Map<ResourceDescriptor, Set<ResourceAccessType>> getReviewAccess(
            Set<ResourceDescriptor> resources, ProxyContext context) {

        return resources.stream()
                .filter(resource -> PublicationService.hasReviewAccess(context, resource))
                .collect(Collectors.toUnmodifiableMap(
                        Function.identity(), resource -> ResourceAccessType.READ_ONLY));
    }
Application makes a call to read own configuration on behalf of user.
server/src/main/java/com/epam/aidial/core/server/security/AccessService.java