> Probably the correct way to handle this is to run the foreign key
> constraint trigger as the user who created the constraint (or
> something like that) rather than the user making the insert. I'm not
> sure how hard that would be.
The problem is that now using both refint and GRANT/REVOKE will not work
together. Only if I have separate areas of tables, I can assure that each
user may work on his own area. But most databases have referencing tables
which parent table is read-only for the simple users and child tables are
read-write for them. My opinion is that it is neccessary to allow such
referencing. If Postgres doesn't support this, almost nobody can use
refint and ACLs together. Performance is also important, I do know...
Regards,
Zoltan