.This question has been answered by multiple community members. See the first response.
public function checkPermissions() {
return $this->modx->hasPermission('class_map');
}Susan is correct (as usual).
All the MODX processors are in core\model\modx\processors\, so the one you need to look at is: core\model\modx\processors\system\derivatives\getlist.class.php.
Here's the relevant code:
public function checkPermissions() { return $this->modx->hasPermission('class_map'); }
Actually I found this place too, but may be I confused with testing permission effect in different browser and flushing permissions...