I've been looking for the right way to restrict access to records, and here's the approach I came up with:

• Adding a "group id" column to the tables, including the users
• Store the users group id on the session

• Adding something like this to each XyzPeer object:

  public static function doSelect(Criteria $criteria, $con = null)
  {
      $user = sfContext::getInstance()->getUser();
   
      if (is_null($criteria))
      {
          $criteria = new Criteria();
      }
      else
      {
          // Objects are passed by reference in PHP5, so to avoid modifying the original, you must clone it
          $criteria = clone $criteria;
      }
      $criteria->add(XyzPeer::GROUP_ID, $user->getGroupId());
   
      return parent::doSelect($criteria, $con);
  }
   

Big thanks goes to everyone else participating in symfony, and specially to Charley Tiggs at the mailing list, who helped me getting started with restricting access to records.