dbauthz functions like GetWorkspaceModulesByJobID check whether the caller has the rbac.ResourceSystem permission. This is fine for now as workspace modules are now used only in telemetry, but as they become used in other places they will need a separate RBAC resource.

Source comment: #15450 (comment)