Nice, I like that a lot, although I imagine it wouldn't work for access control based on non-public data 

 I haven't thought about it like that...
until now. :P