These mechanisms are there. What you also find is that there is often extensive auditing. Every time the data is accessed, there is a record that says it was accessed, so that if there is any sort of problem, the application will report that the application wasn't working right or this end-user was trying to get access to info they weren't entitled to.

Bill Glassman