Nice, I like that a lot, although I imagine it wouldn't work for access control based on non-public data