Best way to store user permissions?

[harryk]

Designing a fairly complicated site with a lot of ajax running on a single page. I have reached the point where some user's need to have specific permission to do things and some need to be stopped from the action. I have set up user roles in my database and all is working fine, but I wonder if there is an easier/safer method for me to store each permission.Currently, when a user logs in their specific permissions are grabbed from the db and loaded into a session array. To check if the user has permission, I simply check to see if the permission is contained in the array. This seems sluggish, and almost like I am missing a better solution.Also, sessions can apparently be edited by the user... is there a safer method?I have thought running a query for each check, but that could greatly increase the load time for a simple ajax request.I am open to any and all ideas. Thanks.