Assuming a hierarchy of workspaces of Root (1) -> Default (2) -> Standard (3) -> Sub1 (4) | Sub2 (5) : If I create a role in v1 RBAC where I've added the ID from the Standard workspace, (3), which has two descendants (4,5) via a current inventory group permission ("inventory:groups:read", "inventory:groups:write", "inventory:groups:*") as an attribute filter on the "group.id" key, when I query my inventory permissions /access/?application=inventory then I should see IDs for workspaces 3, 4 and 5 in my resourceDefinitions in a flat list, for the corresponding role/permission, where today I'd only see 3. No other applications or permissions should trigger this logic.