The RoleServiceImpl and RoleServiceBase classes use a method called getRoleBo excessively which fetches the RoleBo from the database many times during any role check. The RoleBo fetches all of the membership information when it is fetched from the DB even though this information isn't used in any of the logic in the RoleServiceImpl or RoleServiceBase. The KFS implementation at IU has a role which has 4000+ people in it so fetching the membership information adds 2500ms or so to each call to fetch the RoleBo. This adds around 15s of time to any role or permission check which happens to involve that role which is far too long. We have created a "RoleBoLite" which is the same as the RoleBo without the membership information and changing the RoleServiceImpl/RoleServiceBase to use this object instead of the full BO took the 15 second permission check down to 90ms which is more in line with how the service needs to perform.