“There are only two hard things in Computer Science: cache invalidation and naming things.” —Phil Karlton

The simplest approach in your case would be to only keep a local cache on each machine and to invalidate all caches whenever any permission changes. Depending on how frequently you run the same queries and how rarely permissions change in relation to that, this may well be plenty good enough. Beyond that, things can get arbitrarily complex… go there only if real-world performance numbers tell you that you need to.

Makeshifts last the longest.