Your session carries the verdicts your grant produced rather than the grant itself, so what a page may do is settled once at sign-in instead of re-read on every request