diff --git a/plugins/search-backend/src/service/AuthorizedSearchEngine.ts b/plugins/search-backend/src/service/AuthorizedSearchEngine.ts
index cba5f0eca8..3e7dc6e147 100644
--- a/plugins/search-backend/src/service/AuthorizedSearchEngine.ts
+++ b/plugins/search-backend/src/service/AuthorizedSearchEngine.ts
@@ -198,14 +198,27 @@ export class AuthorizedSearchEngine implements SearchEngine {
           const permission = this.types[result.type]?.visibilityPermission;
           const resourceRef = result.document.authorization?.resourceRef;
 
-          if (
-            !permission ||
-            !isResourcePermission(permission) ||
-            !resourceRef
-          ) {
+          if (!permission || !resourceRef) {
             return result;
           }
 
+          // We only reach this point in the code for types where the initial
+          // authorization returned CONDITIONAL -- ALLOWs return early
+          // immediately above, and types where the decision was DENY get
+          // filtered out entirely when querying.
+          //
+          // This means the call to isResourcePermission here is mostly about
+          // narrowing the type of permission - the only way to get here with a
+          // non-resource permission is if the PermissionPolicy returns a
+          // CONDITIONAL decision for a non-resource permission, which can't
+          // happen - it would throw an error during validation in the
+          // permission-backend.
+          if (!isResourcePermission(permission)) {
+            throw new Error(
+              `Unexpected conditional decision returned for non-resource permission "${permission.name}"`,
+            );
+          }
+
           return authorizer
             .load({ permission, resourceRef })
             .then(decision =>