How to limit access to associations / relations with User & Permissions plugin, is it possible?

I have since found that the way to do this is with policies and/or middleware. Specifically, the developer documentation states: