LookupResources

requires you to provide the permission in the first place, so if you know the set of permissions you can fire a series of those. know that they're pretty expensive, though. otherwise you might be waiting until fast ACL filtering comes around.