PermissionCache  

Caches the permission lists of group-ID sets for the lifetime of the application instance.

The permissions a user has are fully determined by the set of group IDs they belong to, so users sharing a group set can share one `group_permission` load. Without this, any code that checks an ability against each serialized user — extension serializer flags, policies, visibility scopers — issues one identical query per user instance. The cache is a container singleton, so its lifetime is one request under PHP-FPM. Entries are invalidated when permissions change: per affected group for model writes, and wholesale for the admin permission endpoint (which writes through the query builder and bypasses model events). Code that modifies the `group_permission` table directly should call `flush()`.