public Collection<Permission> getObjectPermissions() {
        return authzInfo.getObjectPermissions();
    }
Returns all object-based permissions assigned directly to this Account (not any of its realms).

@return all object-based permissions assigned directly to this Account (not any of its realms).
core/src/main/java/org/apache/shiro/authc/SimpleAccount.java