Don,
I almost always use context_id to indicate which permission should be used for an object. How is this denormalized without this information in acs_objects? I guess what I am asking is: how would I need to change my application if context_id is removed from acs_objects? It seems like such a simple and convenient way of assigning permissions.
For instance, I recently created a simple accounting package for maintaining a General Ledger. Each set of books was called an accounting instance, with an instance_id (references acs_objects). I would assign permissions on this instance_id as required. Each instance would have a set of accounts, with account_id. These accounts would have the context_id set to the instance_id.
