Just an observation, this works in general but does so though a (large) number of steps, if we can determine we're working against the standard security subsystem there is a chance to look at the authorization tree and build a regular filter that does the selection, instead of using a function calling back to self though the wrapped object (which is also rather ugly, it's a break of layering..)