Gore... trust me on this... can't be done within the traditional UNIX security policy. Clearly some random exotic third party tool might offer such controls... though who knows what level of assurance they will have.

The Windows security model is more expressive than the UNIX model is... this isn't an opinion it is mathematical fact.

cheers,

catch