Function apply_pointer_permissions 

pub fn apply_pointer_permissions(
    schema: &ClassSchema,
    clp: Option<&ClassLevelPermissions>,
    operation: Operation,
    acl_group: &[String],
    query: &Query,
) -> Result<PointerPermOutcome, ParseError>

Stage two: the query filter. addPointerPermissions (DatabaseController.js:1731-1819).

Never called for master or maintenance.