In an example, a processing device of a datastore system may be configured to identify one or more grants of permission corresponding to one or more first objects, respectively, wherein the one or more first objects comprise only a subset of objects of a datastore, wherein the one or more grants of permission are by a user of the datastore; generate an access control entry for a second object of the objects using at least one of the identified grants of permission, wherein the second object is not exposed to the user; and in responsive to receipt of a query for data corresponding to the objects, determine whether to grant access to the data based on the generated access control entry.