I'm going through the docs and I see I can see permissions for a person per object, I can even list the objects someone has accesss to, The example of The chats. But is it also possible to query which object a person has access to with which permissions? Basically asking the open world question, what can this user do? In our current model we have some implicit permissions, especially when granting. How is this expressed in keto? Do we need to make all permissions explicit?

I think the way to query which permissions are active is the check API right now: https://www.ory.sh/keto/docs/reference/rest-api#operation/getCheck

That is a good post