Nit: usually we're calling hooks without altering the returned value inline - the current approach makes it less obvious that this is a hook and not a plain function. (doesn't matter too much, though).

It looks like it could be more convenient to have a hook that returns a set with all the permissions. But I don't think it is worth changing at this point.

We're changing the logic here - instead of checking the permissions of the thread from the parameter, we're checking the one from the selector. Is it safe? If it is safe, do we still need thread parameter in this callback?