the "ultimate" fast method will be Tiger cache: get a bitmap, use as a filter, post-check the few items that may have had their permission changed since the bitmap was updated