Global ACL in SQL or LDAP possible?