Where to authorize an insert?

The description of the `check` and `load` callbacks https://hexdocs.pm/phoenix_sync/Phoenix.Sync.Writer.html#module-callbacks indicates that:

1. check should not hit the DB (all checks are run together before iterating through the operations)
2. load is not called for an insert

So where should I authorize an insert?