using the API directly from each endpoint is unsafe in this case in my opinion. it would be much more ideal to bundle some sort of data structure into the table implementation and perform the check against the static ruleset locally