When a model's owner (user/org) isn't in the token's fine-grained scopes AND the model itself isn't directly scoped, the Permission can end up blank, which is a proto violation. So, move those cases to unbounded resources.
When a model's owner (user/org) isn't in the token's fine-grained scopes AND the model itself isn't directly scoped, the Permission can end up blank, which is a proto violation. So, move those cases to unbounded resources.