Doug,

>My users are concerned about security and want us to build in levels of access into a system.

Some thoughts:

1) Use SQL Server or MSDE for the backend

2) or... Put all data access into VFP remote COM components that can run with their own identity. Limit data directories to that identity, so no one can directly get to the tables. Put any kind of other user security scheme you want inside of the data-access classes to further restrict access of anyone who instantiates them.