The ProfileBasedRightsManager API doesn't define any update(Profile) method, as the GroupsManager API does.
Adding rights to a profile is therefore delegated to the Profile.addRight method, which adds rights one by one.

When profiles are stored in a database (i.e. 100% of cases), adding one right to a profile which already contains 50 makes 52 JDBC queries: one DELETE (call to removeRights), and one INSERT per right (calls to addRight), both old and new.
Not only does this poses a performance problem (which leads to a wait message being required - RUNTIME-739) but this could lead to an integrity issue.

Two solutions:

• Minor rewrite of the API, adding beginUpdate() and endUpdate() to the Profile interface, which would start/commit a transaction.
• Major rewrite of the API, to be coherent with the GroupsManager way of doing things: a Profile is a class (bean) and not an interface, and it's the ProfileBasedRightsManager responsibility to update and remove it (update and remove methods similar to GroupsManager's methods).