dbauthz functions likeGetWorkspaceModulesByJobID check whether the caller has therbac.ResourceSystem permission. This is fine for now as workspace modules are now used only in telemetry, but as they become used in other places they will need a separate RBAC resource.

Source comment:#15450 (comment)