what if they have create permissions but not read permissions?  This is actually a common configuration -- you can register for an event, say, but can't see the registration after you've submitted it.