Sounds good to me. Would it be possible, once context_id were in its own table, to have multiple contexts for an object, that is permissions on several higher up objects could be used to grant permission on the lower level objects? Even though it make perfect sense that there be only one partent of an object, multiple contexts should be possible.
The morass of triggers makes it difficult to figure out how the kernel works, I guess the end result is that applications would need to add an additional database call to set the context. A tcl call along the lines of set_object_context(:object_id,:context_id) would make it simple.
