How can I restrict the key of a dictionary field in Hibernate?

Question

We have a class "Foo" which requires some limited security. In particular, we have defined Authors, Editors, Owners, and Account Managers (aka RoleManager) for each 'foo'.

The DB mapping table contains a FooID, a UserID, and an integer (binary representation of flags) which are used to determine which of those 4 roles you have on which calendars.

I'm looking to construct a query which will find "All the Foos for which the designated user has any permission."

The SQL would be fairly straightforward, SELECT Foo.* FROM Foo f INNER SecurityTable st ON f.ID = st.ID WHERE st.UserID = @UserID but I have no idea how to make this work in NHibernate and get back objects of type Foo.

<hibernate-mapping xmlns="urn:nhibernate-mapping-2.2" assembly="XXX.YYY" namespace="XXX.YYY">
<class name="foo" table="foo" schema="dbo" mutable="true">
    <id name="ID" column="FooID" type="Guid" access="nosetter.lowercase-underscore">
        <!-- Database ID value assigned by class constructors, not NHibernate. -->
        <generator class="assigned"/>
    </id>

    <property name="Name" column="Name" type="string" not-null="true"/>
    <property name="Description" column="Description" type="string"/>
... (etc)

    <map name="UserPermissions" table="FooUserPermissions" lazy="true" cascade="all">
        <key column="FooID"/>
        <index-many-to-many class="MembershipUser" column="UserGUID" />
        <element column="Permissions" type="FooPermission" not-null="true" />
    </map>

</class>

Class FooPermission is an enum with flags 1 = author, 2 = editor, 4 = owner, 8 = rolemanager.

The UserPermissions dictionary is defined in class foo:

public virtual IDictionary<MembershipUser, FooPermission> UserPermissions
    {
        get
        {
            if (_userPermissions == null)
            {
                _userPermissions = new Dictionary<MembershipUser, FooPermission>();
            }
            return _userPermissions;
        }

        protected internal set { _userPermissions = value; }
    }

Class MembershipUser has an ID field which is a Guid (I could restrict this) or a Username field which is a string (that would also work).