Concerning speed-up via SQL:
The main speed problem is for index templates: After the SQL has returned it will check all issues
*in python* for visibility. And I think for every issue all permissions are checked again in the same
order.
There are fast permission checks that pass almost instantly like when the user has access to the whole class.
There are slow permission checks that require execution of a check method in python. A permission check method in python might make further queries slowing down things even more.
The idea outlined in earlier messages of sorting permissions by speed (i.e. the ones with check
methods would be sorted last) would fix the problem for users having permissions without a check
method because the first check that passes terminates the permission check.

For users *only* having permissions that require execution of a check-method we could speed this up if
- we can formulate a fast permission check (either in SQL or in something similar to the current
  query language of the REST API), this would be ANDed in SQL with the generated user query. If
  such a method is present we would *not* filter issues in python but instead rely on SQL to return
  only visible issues
- A permission on the whole class without a check method would have a trivial "True" here
- This would be *in addition* to the normal visibility checks but after retrieval of the list of
  issues from SQL we would *not* run checks in python to determine which issues to show
- If there are several permissions with check methods this would only work if all of them have the
  fast permission check set. The fast permission checks for several issues would need to be ORed in
  SQL.

The reason why this would speed up things is that we do a first visibility check in SQL. Only later will we check each issue for visibility but this will occur only for a handful of issues displayed in one batch of the index template.

Let me know what you think...