Override Permissions methods to avoid expensive calls to DomainPolicy.lo...

...adValues. Fixes #351.
Nit: this is called *maximums* in the original impl.