The maddening thing about this is that the world-standard database format, SQL, includes as standard the ability to define, grant, and revoke levels of permission for any and all users on the system. Quite simply you GRANT read, edit ON recruits for each user, or each group of users; under no circumstances do you GRANT ALL ON recruits to anyone but the db administrator. However, it seems anyone in government gets to use the DUMP command (i.e. export all records to local disk)...