select users from users in class md.user.User where users.id in
(select distinct users from instance in class md.user.Instance
,users in instance.users.elements
,rolex in users.persistentRoles.elements
,permission in rolex.permissionSet.permissions.elements
,role in permission.roles.elements where role in
(select userz.persistentRoles.elements from userz in class md.user.User where userz.username = 'username') and
permission.operation in
(select operation from operation in class md.user.Operation where operation.name = 'view-others') and
instance.id = 1 and users.username like '%m%') order by users.address.lastName


That's the beast. The concept is using role based access control. The rough english translation of the above query is "select the set of users that the current user has view-others permission on." At least, this is what we want to accomplish.

Any help? Need more information, please let me know.

Thanks.

why don't use load it into some form of cache, (and reload cache on changes?)