True when an account action would change which permissions the account holds, through its permission_ids argument.

• A create changes them when permission_ids names any permission.
• An update or a generic action (its :id argument names the account) changes them when permission_ids is given and differs from what the account holds now. An argument left out, or the account's own permissions sent back unchanged — as the account form does — changes nothing.

A policy condition, so a gate asked only of a grant sits beside the one every edit asks:

policy [action([:tenant_create, :tenant_update]), MishkaCmsCore.Accounts.Checks.ChangesPermissions] do
  authorize_if {MishkaCmsCore.Accounts.Checks.AccessPermissions, permissions: ["admin:dashboard:permission", "admin:api:permission"]}
end