This uses the same thinking as the earlier `run_permission_checks`
refactor, to run all of the checks for the matrix in a single `it` block
to avoid repeated setup.