diff --git a/backend/v3/storage/database/query.go b/backend/v3/storage/database/query.go
index df3ee0a37..11e528752 100644
--- a/backend/v3/storage/database/query.go
+++ b/backend/v3/storage/database/query.go
@@ -57,6 +57,14 @@ func WithLeftJoin(table string, columns Condition) QueryOption {
 	}
 }
 
+// WithPermissionCheck enables a check if the authenticated user has the
+// passed permission to read or write a resource.
+func WithPermissionCheck(permission string) QueryOption {
+	return func(opts *QueryOpts) {
+		opts.Permission = permission
+	}
+}
+
 type joinType string
 
 const (
@@ -100,6 +108,9 @@ type QueryOpts struct {
 	// Joins is a list of joins to be applied to the query.
 	// It is used to build the JOIN clauses of the SQL statement.
 	Joins []join
+	// Permission required to read or write the resource.
+	// When unset, no permission check is made.
+	Permission string
 }
 
 func (opts *QueryOpts) Write(builder *StatementBuilder) {
diff --git a/backend/v3/storage/database/repository/doc.go b/backend/v3/storage/database/repository/doc.go
index bd01ea6de..675c5df3a 100644
--- a/backend/v3/storage/database/repository/doc.go
+++ b/backend/v3/storage/database/repository/doc.go
@@ -1,4 +1,4 @@
-// Package implements the repositories defined in the domain package.
+// Package repository implements the repositories defined in the domain package.
 // The repositories are used by the domain package to access the database.
 // the inheritance.sql file is me over-engineering table inheritance.
 // I would create a user table which is inherited by human_user and machine_user and the same for objects like idps.