Jerry, you might look at my notes on the subject contained in
a thread on relational segments. There is not a single table that contains all these rows, permission_p now uses a join of three tables. I think I was taking heavy medication for a back strain when I talked of the join as 'sublime'. Now I'm sobered up, but I still think it is sublime. This join pretty much explains permissions to me and how to grant and test them.