When searching for a user (e.g. page permissions), the Velocity variables are rendered to the screen, instead of the actual values. Tom tells me this is because when you search for a group, the username is returned, rather than a User object, so calling $user.name on the username doesn't work.