Because we search for permissioned labels which all have the same
top-level group, we can preset root_ancestor for them before permission
check. This optimization saves us extra query to fetch root ancestor
(called from group policy).