If you want the permissions available in the web tier as well, use XDoclet to aggregate the value objects for you.
Are you creating value objects manually? If so, take the time to look at XDoclet, which creates them for you.
When the user is read, all the permissions will be read and appropriate value objects put into the user value object as a collection for you.
I must admit that since my last post I have spotted that you can do it all in XDoclet. But thanks anyway.
What happens if I had a deep relationship? For example each user had permissions and each permission had a method for listing each user with that permission. What should be done then, cos that sounds like one hell of an operation to do
You can decide which data to include in the value object. And you can have different versions of value objects for the same class containing different data.
So it would make sense to have a value object on the user which included related value objects from the permissions, but which did NOT then recursively include the user value objects again (infinite loop).
It would still be possible to code a different value object on the permission object which included the users.
Start by having a look at the value object documentation on the xdoclet website (xdoclet.sourceforge.net).
I have to say, XDoclet documentation is rather opaque, so you'll probably have to get onto the XDoclet mailing lists to ask the relevant questions.