since CheckPermission requests almost always subdivide into subproblems, and most of those are shared, that cache hit rate can be quite high