"Max Lamprecht, ok, now I can..." <- ahh nice, thought already that i´m doing something heavily wrong with my setup :D I´m not sure if a 2nd group by is the right way for subnets. The problem is that this 2nd join is generated by sqlalchemy due to lazy="joined". Previously with the lazy="subquery" option it fetched only once the complete networkrbac table in a seperate query. Another option could be lazy='selectin' than sqlalchemy will directly filter on the foreignkey (network-id).