private Map<ResourceDescriptor, Set<ResourceAccessType>> lookupPermissions(
            Set<ResourceDescriptor> resources, ProxyContext context, Set<ResourceAccessType> toLookup) {
        Map<ResourceDescriptor, Set<ResourceAccessType>> result = new HashMap<>();
        Set<ResourceDescriptor> remainingResources = new HashSet<>(resources);
        for (PermissionRule permissionRule : permissionRules) {
            Map<ResourceDescriptor, Set<ResourceAccessType>> rulePermissions =
                    permissionRule.apply(remainingResources, context);

            // Merge permissions returned by the rule with previously collected permissions
            rulePermissions.forEach((resource, permissions) -> {
                Set<ResourceAccessType> mergedPermissions = result.merge(resource, permissions, Sets::union);
                if (toLookup.equals(mergedPermissions)) {
                    // Remove from further lookup if all requested permissions are collected
                    remainingResources.remove(resource);
                }
            });

            if (remainingResources.isEmpty()) {
                break;
            }
        }
        for (ResourceDescriptor resource : resources) {
            result.computeIfAbsent(resource, r -> Set.of());
        }

        return result;
    }
The method returns permissions associated with provided resources.
Check sequence:
<ul>
  <li>Own resources</li>
  <li>Admin access</li>
  <li>Auto shared</li>
  <li>App resource</li>
  <li>Shared access</li>
  <li>Public access</li>
  <li>Review resource</li>
</ul>

@param resources - resources to retrieve permissions for
@param context - proxy context
@return User permissions to all requested resources
server/src/main/java/com/epam/aidial/core/server/security/AccessService.java