I *really* don't want to tune this particular, but discuss the size of kernel metadata tables...
If you want to make the CBO defer the evaluation of PL/SQL functions you can try this:
select * from
(select rownum, a,b,c
from d,e,f
where ...)
where acs_permission.permission_p(...)='t';
Try it. I find the TCL solution very, very kludgy.