"When a user logs into the system, a flat list of his/her permissions is compiled according to the permissions assigned to the user through his/her assigned roles and directly assigned permissions."
If you have a look at the RBS source code, you will see that GetPermission will try to get the value from a Dictionary added with the user's permissions. This is initialized when the user is Authenticated. So, there won't be a trip to the server when GetPermission is used.