Why does an admin assuming the role of another user require two different permission checking functions? Wouldn't the user_id just be substituted? And why would you split the functionality of the two new functions at the directly granted/inherited permissions level? What unwanted results are you getting from the current set-up? So many questions!
