It has been awhile for me but last time I checked there were several layers of security. Using the catalog as the repository, you can assign passwords to individual users and grant or deny access to individual tables, views, or data elements within tables. Don't know if it is still true but Impromptu was (maybe is) known for it's flexible and powerful admin/security functionality. One word of caution, getting very fancy with the setup of access security may result in a significant amount of maintenance later. There is always a price to be paid, as they say.