I've been trying to understand node access and things are starting to come together however I believe there is something missing - unless I've missed something ;)
It would seem that owners of a node lose access to a node they've created if the owner doesn't have the permission being checked for using node access. Implementing node_access_example for instance wipes out a user's blog for them since they don't have access and they can't change the private flag since they don't have access. I find it ironic that other's could view thier content but not them.
The obvious answer is to enable whatever permission the user is supposed to have to allow them to read private nodes - however I don't believe this is the way it should work.... A user should be able to read their own private nodes, without being able to read other peoples private nodes...
This doesn't seem possible under the current scheme.
It seems that this is because of the way node access works, since the grants seem to be an all or nothing thing.
Essentially unless a node is specifically allowed by having an entry in the node_access table or a user is specifically granted the correct permission for that realm they don't see nodes based on that realm...? Do I understand that correctly?
I was trying to think of way to build a module that would fake this out somehow - like create a node_access table entry each time a user adds a node, say for realm node_owner that would then have a partner hook_node_grant that granted only the actually node owner a permission - but even this seems impossible as the whole thing is wrapped up in a sql that doesn't consider each individual $nid.