Preserve alternative access paths when moving checks into SQL
When moving authorization filtering ahead of a bounded SQL read, preserve the union of independent access paths. A narrow direct membership must not replace broader access separately granted through an organization relationship. Otherwise the application may authorize a record wh…