>>>While preferably this would be done in the data tier, we do it in the business tier because our app can have multiple backends. By having it handled via code at the business level the backend is not germain. It suits our purposes fine.
>>>
>>>Of course you could create a separate 'logical' data tier in code to handle this type of thing. You could create your own data objects and place your appropriate code there depending on the backend type. Probably some would do that. It adds another level to maintain though but would work as well.
>>>
>>Tracy,
>>
>>Thanks a lot for your input. So far I have 3 votes for doing it in Business logic against 0 votes for doing it in database itself.
>
>And if you want implement a open db application ?
>If you put rules into the db triggers/checks you can open the db interface,
>otherwise you have to close the db into a inaccessible box,
>and build a business logic engine interface.

Exactly! It all boils into implementing proper security. I read some discussion on wiki from Anatoly Mogilevitch about how to handle this. Haven't yet chance to try his idea.