I would argue for making the "system owner" an entry
in acs_magic_objects, but if that seems appalling and you
prefer Peter's method you should probably do it with a
join to the permission view rather than with the permission_p
function (which will force a table scan on users).
