In the thread started by Peter over in web/db Aram mentions that the permissions system performs well if you get rid of the PL/SQL calls and include the code as part of your query.
I've suspected this would be the case for some time. While I hate the notion of burying dependencies on the permissions datamodel into client code, we may have to bite the bullet and do as Aram suggests, at least for crucial permissions checks that are executed very frequently.
