Security checks for modules and module items revisited

While trying out the dyn_example module with object->checkAccess(), I 
hit the issue that normal security checks in dyn_example use their own
security masks ViewDynExample, ReadDynExample, EditDynExample etc.

My first reaction was to support overriding the default DD security
masks in object->checkAccess somehow based on the masks defined by the
'owner' module, but then I started wondering what the point of those
security masks for module items was if DD controlled the access anyway.

Which led me to the conclusion that for simple cases like dyn_example
we might as well get rid of module-specific security masks to control
the access to items, and let DD handle them. This leaves the following
open issues:

1. access to the module admin part (= independent of DD objects), which
    could conceivably be replaced by some generic module->checkAccess()
    routine for all modules.
2. use of the old security masks in xar:sec tags in module templates,
    which could be replaced if we have an object instance in the template
3. use of the old security masks to build up items for the admin menu,
    which would require instantiating an object instance for the menu
4. other restrictions based on module functionality that has nothing to
    do with objects or generic module access (= not in dyn_example).

Only the last one requires specific security masks (or something) - the
others could be solved with either a generic module checkAccess() or
adapting the module to rely on object checkAccess() for module items.

Any thoughts on any of those options ?


Mike.
P.S.: I haven't changed dyn_example yet, but if this is a good way to go 
on, it'd be easy to do once we have a module checkAccess() with at
least 2 access levels (view and admin)