> Also, you've got code (plugins) that are really configuration items (who can login, etc). Don't conflate behaviors (code) with input (data).
I guess I was unclear. The reconciliation program figures out that a person should be able to login (because of the import flags). The plugin is given a person and told that this person either gets to login, or doesn't. The plugins are designed not to need any knowledge of which queries guarantee the permission, just that this record needs it.