diff --git a/CHANGES.txt b/CHANGES.txt
index 38d003acf6..1ae082009c 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 3.0.32
+* Minimise expensive reads during authz flow in 3.0/3.11 (CASSANDRA-20293)
 
 
 3.0.31
diff --git a/src/java/org/apache/cassandra/service/ClientState.java b/src/java/org/apache/cassandra/service/ClientState.java
index 8ab6887c5b..9fefb7c141 100644
--- a/src/java/org/apache/cassandra/service/ClientState.java
+++ b/src/java/org/apache/cassandra/service/ClientState.java
@@ -364,9 +364,9 @@ public class ClientState
             if (((FunctionResource)resource).getKeyspace().equals(SystemKeyspace.NAME))
                 return;
 
-        if (resource instanceof DataResource && !(user.isSuper() || user.isSystem()))
+        if (resource instanceof DataResource)
         {
-            DataResource dataResource = (DataResource)resource;
+            DataResource dataResource = (DataResource) resource;
             if (!dataResource.isRootLevel())
             {
                 String keyspace = dataResource.getKeyspace();
@@ -376,7 +376,8 @@ public class ClientState
                 // see the Permission enum for details.
                 if (Schema.isSystemKeyspace(keyspace))
                 {
-                    ensurePermissionOnResourceChain(perm, Resources.chain(dataResource, IResource::hasParent));
+                    if (!(user.isSystem() || user.isSuper()))
+                        ensurePermissionOnResourceChain(perm, Resources.chain(dataResource, IResource::hasParent));
                     return;
                 }
             }