diff --git a/api/graph/model/acl.go b/api/graph/model/acl.go
index 0e841a0..d7db4e6 100644
--- a/api/graph/model/acl.go
+++ b/api/graph/model/acl.go
@@ -93,6 +93,7 @@ func (acl *TrackerACL) QueryWithCursor(ctx context.Context, runner sq.BaseRunner
 		q = q.Where(database.WithAlias(acl.alias, "id")+"<= ?", next)
 	}
 	q = q.
+		Column(`permissions`).
 		OrderBy(database.WithAlias(acl.alias, "id")).
 		Limit(uint64(cur.Count + 1))
 
@@ -103,10 +104,19 @@ func (acl *TrackerACL) QueryWithCursor(ctx context.Context, runner sq.BaseRunner
 
 	var acls []*TrackerACL
 	for rows.Next() {
-		var acl TrackerACL
-		if err := rows.Scan(database.Scan(ctx, &acl)...); err != nil {
+		var (
+			acl    TrackerACL
+			access int
+		)
+		if err := rows.Scan(append(
+			database.Scan(ctx, &acl), &access)...); err != nil {
 			panic(err)
 		}
+		acl.Browse = access & ACCESS_BROWSE != 0
+		acl.Submit = access & ACCESS_SUBMIT != 0
+		acl.Comment = access & ACCESS_COMMENT != 0
+		acl.Edit = access & ACCESS_EDIT != 0
+		acl.Triage = access & ACCESS_TRIAGE != 0
 		acls = append(acls, &acl)
 	}
 
diff --git a/api/graph/schema.resolvers.go b/api/graph/schema.resolvers.go
index fbd5933..e1703da 100644
--- a/api/graph/schema.resolvers.go
+++ b/api/graph/schema.resolvers.go
@@ -464,7 +464,7 @@ func (r *trackerACLResolver) Tracker(ctx context.Context, obj *model.TrackerACL)
 }
 
 func (r *trackerACLResolver) Entity(ctx context.Context, obj *model.TrackerACL) (model.Entity, error) {
-	panic(fmt.Errorf("not implemented"))
+	return loaders.ForContext(ctx).UsersByID.Load(obj.UserID)
 }
 
 func (r *trackerSubscriptionResolver) Tracker(ctx context.Context, obj *model.TrackerSubscription) (*model.Tracker, error) {