Function check_permission 

pub async fn check_permission(
    db: &Db,
    identity: &Identity,
    permission: &str,
) -> Result<bool>

Ask “does this identity have permission X?”.

Order of checks (load-bearing):

1. is_active — an inactive user is denied even if their role would bypass group checks.
2. bypasses_group_checks — Administrator and Developer skip the M2M lookup; every other tier consults the tables.