public void filterForbidden(ProxyContext context, ResourceDescriptor descriptor, MetadataBase metadata) {
        if (descriptor.isPublic() && descriptor.isFolder() && !hasAdminAccess(context)) {
            ResourceFolderMetadata folder = (ResourceFolderMetadata) metadata;
            ruleService.filterForbidden(context, descriptor, folder);
        }
    }
Application makes a call to read own configuration on behalf of user.
server/src/main/java/com/epam/aidial/core/server/security/AccessService.java