I agree the TCL solution is kludgy (perhaps even worse if you use db_multirow), but I've found that Oracle is way to cleaver to be fooled by something like
select * from
(select blah)
where acs_permision() = 't'
I'm running 8.1.7. Perhaps other versions are not so smart.
