That feature's documented in the code, actually (boy, I'm a smart-ass). Not the most convenient place for it...
select * from
(select o1.object_id, o2.name from acs_objects o1, acs_objects o2
where o1.blah = o2.blah) foo
where 't'= (select acs_permission.permission_p(:user_id,foo.object_id,'read') from dual)
will awkwardly force a smarter scan on the inner query. Andrew Grumet found this out while working on improving the performance of file storage.
The simpler "'t' = acs_permission..." (without the subselect/dual) will still do a full table scan.
Oracle's bleeping stupid at times.
