thanks pavan, ok so it looks like it'll be a combination of the business rule and ACLs.  really appreciate the help!