select max(read_access)
    from acl, session
    where acl.group_id = session.group_id and
          acl.item_id = :ITEM and
          session.user_id = :USER