when the request is checked against permissions and/or other security controls