Groovy, I'm following you.

"ACL" is actually how we name tagged our implementation as well (although it's a custom hybrid of sorts, in a very dynamic and ever changing environement)

Transactional data in the end, along with control lists, dictates the rendered dataset

And this actually negates the need for any additional security.

reports access is granted to everyone, but if you are not who you are supposed to be, your report runs for 1 second and returns nothing.

Thanks for the posts..tapering off here ...