Checking a user's permissions on an asset from the REST api

[knexator]

I want to make a service external to the connector (not necessarily in java), that exposes /see_first_element?asset_id=<asset_id>&user_token=<user_token> (or in general, some service other than data transfer). Only authorized users should be able to access this API; I want to use the EDC Connector to handle this authorization: users should have a valid agreement that includes that specific asset, with a policy that allows the "see first element" scope.

I have been looking at the documentation and running the MVD, but haven't found a way to achieve this, either by calling the connector's REST api or some other way.