protected function executeInternal(SelectStatement $selectStmt, $buildDepth, PagingInfo $pagingInfo=null) {
    $type = $this->getQueryType();
    $mapper = self::getMapper($type);
    $permissionManager = ObjectFactory::getInstance('permissionManager');
    $loadOidsOnly = ($buildDepth === false);

    // execute the query
    $result = [];
    if ($loadOidsOnly) {
      $data = $mapper->select($selectStmt, $pagingInfo);

      // collect oids
      for ($i=0, $count=sizeof($data); $i<$count; $i++) {
        $oid = $mapper->constructOID($data[$i]);
        if ($permissionManager->authorize($oid, '', PersistenceAction::READ)) {
          $result[] = $oid;
        }
      }
    }
    else {
      $objects = $mapper->loadObjectsFromSQL($selectStmt, $buildDepth, $pagingInfo);

      // remove objects for which the user is not authorized
      $persistenceFacade = ObjectFactory::getInstance('persistenceFacade');
      $tx = $persistenceFacade->getTransaction();

      // remove objects for which the user is not authorized
      for ($i=0, $count=sizeof($objects); $i<$count; $i++) {
        $object = $objects[$i];
        $oid = $object->getOID();
        if ($permissionManager->authorize($oid, '', PersistenceAction::READ)) {
          // call lifecycle callback
          $object->afterLoad();
          $result[] = $object;
        }
        else {
          $tx->detach($oid);
        }
        // TODO remove attribute values for which the user is not authorized
        // should use some pre-check if restrictions on the entity type exist
      }
    }
    return $result;
  }