In CollectionFunctions Resource, you can find the service ExportUserPermissions which exports all permissions to an xml file in a Thingworx repository.
Search for the name of the user in the xml file and you will see his permissions.
Among the input parameters of the service are: includeCollectionPermissions, includeDependents, includeEntityPermissions.
Thanks Cristina, that's really useful. I was hoping it would contain all the user's permissions, but perhaps I unintentionally constrained my question too much! I did keep saying entities, I know, but I suppose I was assuming that all permissions would be related to one entity or other. It appears that the permission to export entities is stored elsewhere: I don't suppose you know where that is, do you?