I just had a similar issue with EclipseLink, wherein Permissions were not saved properly. Granting multiple permissions on the same resource would result in only the last permission saving. Consider the following:

permissionManager.grantPermission(assignee, User.class, Permissions.CREATE);
permissionManager.grantPermission(assignee, User.class, Permissions.READ);
permissionManager.grantPermission(assignee, User.class, Permissions.UPDATE);
permissionManager.grantPermission(assignee, User.class, Permissions.DELETE);

In this example, only the final "DELETE" permission would be found in the database.

I debugged PicketLink and saw that it was concatenating the permissions properly. It wasn't until I found this bug that I turned of weaving for changed tracking, and it worked. This may not be the best solution, waiting to see if any others are found.