Thanks for that Perrin - I wasn't aware of the ::Managed version of memcached, and it looks like it could solve some other issues in my system, but probably not for privileges.

Privileges may not change that frequently, but when they do change, they can have a far reaching effect, so it makes more sense to take the hit of working out which cached values to expire at the moment that something changes, rather than working out the namespaces right from the beginning.

However, I think your suggestion of using a memory table in MySQL for the privilege cache is probably spot on. It'd be fast, centralised and easy to manage, and comes with the indexes I need to expire the changed values intelligently.

The only problem I can see is the possibility of two processes interacting, where one caches a value low down in the privilege tree, while the other is changing a value higher up - I'll probably need to work through that with locking... which should be fine because these are all fast simple queries.

thanks - heart more at rest now...