I'd also add that groups and permissions are probably constant and can be cached with a long timeout.