OMG - now I feel like an idiot 
That did not occur to me at all - especially since my record is in fact related to itself (a recursive relation). I added find/findOne/update/create (I will play around to see which minimum set is really needed) to Authorized role and now it works. Damn
Thank you!