diff --git a/lib/galaxy/model/security.py b/lib/galaxy/model/security.py
index 738db0b548c..3e5690e78fc 100644
--- a/lib/galaxy/model/security.py
+++ b/lib/galaxy/model/security.py
@@ -500,7 +500,7 @@ class GalaxyRBACAgent(RBACAgent):
     def item_permission_map_for_add(self, trans, user_roles, libitems):
         return self.allow_action_on_libitems(trans, user_roles, self.permitted_actions.LIBRARY_ADD, libitems)
 
-    def can_access_dataset(self, user_roles, dataset):
+    def can_access_dataset(self, user_roles, dataset: galaxy.model.Dataset):
         # SM: dataset_is_public will access dataset.actions, which is a
         # backref that causes a query to be made to DatasetPermissions
         retval = self.dataset_is_public(dataset) or self.allow_action(
@@ -1122,7 +1122,7 @@ class GalaxyRBACAgent(RBACAgent):
             if not dataset.purged and not self.dataset_is_public(dataset):
                 self.make_dataset_public(dataset)
 
-    def dataset_is_public(self, dataset):
+    def dataset_is_public(self, dataset: galaxy.model.Dataset):
         """
         A dataset is considered public if there are no "access" actions
         associated with it.  Any other actions ( 'manage permissions',
diff --git a/lib/galaxy/webapps/galaxy/controllers/root.py b/lib/galaxy/webapps/galaxy/controllers/root.py
index eda5a45ae26..ce48fc68c00 100644
--- a/lib/galaxy/webapps/galaxy/controllers/root.py
+++ b/lib/galaxy/webapps/galaxy/controllers/root.py
@@ -107,8 +107,9 @@ class RootController(controller.JSAppLauncher, UsesAnnotations):
         if "authz_method" in kwd:
             authz_method = kwd["authz_method"]
         if data:
-            current_user_roles = trans.get_current_user_roles()
-            if authz_method == "rbac" and trans.app.security_agent.can_access_dataset(current_user_roles, data):
+            if authz_method == "rbac" and trans.app.security_agent.can_access_dataset(
+                trans.get_current_user_roles(), data.dataset
+            ):
                 trans.response.set_content_type(data.get_mime())
                 trans.log_event(f"Formatted dataset id {str(id)} for display at {display_app}")
                 return data.as_display_type(display_app, **kwd)