Are there any web frameworks out there with really solid access controls baked in? As an unprivileged user on a UNIX box, if I maliciously or inadvertently scr

Are there any web frameworks out there with really solid access controls baked in? As an unprivileged user on a UNIX box, if I maliciously or inadvertently screw something up, about the worst thing I can do is blow away my home directory or maybe soak up enough machine resources to make everyone else's processes slow down. As an unprivileged user on a poorly-secured web app, I can potentially blow away pretty much anything that the web server and/or database user has access to. Granted, creating a new database user or shell account every time someone signs up for something like, say, Twitter probably wouldn't scale. But a carefully-written web app environment that could scale to millions of users (each with privileges to see/alter only their own data) sure would be nice. I suspect the place to do this would be at the data store level, where (for instance), given a login cookie the app could obtain a set of capabilities on only the data that the user has access to. It would change the default allow that seems to be the current practice into more of a default deny. Anyway, I'm rambling now. I'll stop.