>Thanks for your input. Your response focuses on the normalization aspect & seems to support option "A" (with redesign of how keys are set up.)
>
>Question: if a set of privilege setting options are specific to a given application, aren't they more effectively handled as attributes of that application's user record, instead of placing them in a separate "privilege" table? I thought that normalized meant that (A) all attributes are dependent of the key combination (which in this setting seems to be application + user), as well as (B) being independent of each other.
>
If there was one and only one privilege for a user, perhaps. But you know there will be more. I normalize by identifying the entities. A privilege is potentially an entity.

So you need Users 1:M Applications 1:M Privileges.