See slide 72 of the metadata talk[1] and slide 51 of the IPC talk[2], which indicate that it does speculation before permissions checking.
Since turf permissions operate on the granularity of an arbitrary address range (rather than a page like traditional MMUs), the permissions cache (what the Mill calls a PLB) has a worse latency/power tradeoff than a traditional TLB. The Mill takes advantage of its single address space and reduces some of this hit by doing permissions checks in parallel with the access.
The L1$D is accessed in parallel with the PLB. Both at top-level caches - one for data, one for protection.
If there is a PLB miss we have no cache-visible side-effects until the protection has been resolved.
The paper we're preparing will cover this in detail, because as you can see, the talks are a bit light on exactly what happens in what order when here.
