How is everyone handling record security, when requirements require dynamic visi

I was thinking a bit more about this over the weekend and it occurs to me that there may be another approach to solve the issue of determining membership of these private groups without using so much of a workaround. What if you created a new group (with a less strict permission level), something along the lines of "X Record Superuser Viewers" - and add whichever groups will always see all record listings as members of that group. That way your expression could check for membership of that group (from a constant or whatever), without needing to "see" the private groups. This would also protect you from issues if the "doesuserbelongtogroupnamed()" rule's permissions ever get changed without warning.

I was thinking a bit more about this over the weekend and it occurs to me that there may be another approach to solve the issue of determining membership of these private groups without using so much of a workaround. What if you created a new group (with a less strict permission level), something along the lines of "X Record Superuser Viewers" - and add whichever groups will always see all record listings as members of that group. That way your expression could check for membership of that group (from a constant or whatever), without needing to "see" the private groups. This would also protect you from issues if the "doesuserbelongtogroupnamed()" rule's permissions ever get changed without warning.