When you ask for a list of clauses during JQL -> Lucene coversion you call getClauseHandler for each clause. When we do this use return a filtered list of clauses that the user is able to see. The code is:

public Collection<ClauseHandler> getClauseHandler(final User user, final String jqlClauseName)
{
  return filter(getClauseHandler(jqlClauseName), new PermissionToUse(user));
}

This call can be quite expensive especially when a JQL query has the same clause multiple times (e.g. project = JRA or project = BJB). This manifests itself in expensive .size() class during query creation (who knew):

We could possibly fix this by caching the permissions calculations for a request (or maybe longer).