Excellent, thank you! I never thought of going to the database tables for this data.
I want certain things to happen if a user belonging to RoleX accesses a document that RoleX has READ permissions for. (I could have done this differently using different document types along with SecurityEvents.AuthorizeClass ... but that would have caused other headaches.)