ACE - Problem with creation of selective BP Rule

Question

Hello Experts,
I want to restrict the visibility of Accounts with ACE into CRM. The users should only have the right to see Accounts (Sold-to) with the same sales organization as himself.
Therefore if implemented the Interface Method GET_ACTORS_FROM_OBJECTS :
  TYPES: BEGIN OF partner_data,
          partner         TYPE bu_partner,
          partner_guid    TYPE bu_partner_guid,
        END OF partner_data.
  DATA: lt_partner_data TYPE TABLE OF partner_data,
        ls_partner_data TYPE partner_data,
        lv_guid TYPE bu_partner_guid,
        ls_object_guid TYPE crms_ace_object_guid,
        lv_rltyp       TYPE bu_partnerrole.
  SELECT partner partner_guid FROM but000 INTO CORRESPONDING FIELDS OF TABLE lt_partner_data.
  LOOP AT lt_partner_data INTO ls_partner_data.
    SELECT SINGLE rltyp FROM but100 INTO lv_rltyp WHERE partner = ls_partner_data-partner.
    IF lv_rltyp EQ 'CRM000'.
      ls_object_guid-object_guid = ls_partner_data-partner_guid.
      APPEND ls_object_guid TO ex_object_guid_table.
    ENDIF.
  ENDLOOP
Everything works fine, and the users could only find the accounts which have the same sales organization as the user.
But now, the users couldn't find any contact person in the system.
My solution for that problem was to implement a second ACE rule, where the users get access to all other BP except Accounts.
For me, this solution is unsatisfactory!
In a system with about 100.000 Contacts this solution would significally degrade the performance. There will be thousands of entries in the ACE tables which weren't needed.
I only want to filter the Accounts mit ACE and nothing more.
Is there a possibility to filter only Accounts with ACE?
Regards
Steffen

Answer 1

Hi Steffen,
with the activation of ACE this is indeed one of those side effects.
isn't there any way to do some extra coding in the runtime check of ACE? If you can check there is the object the user wants to see is a person that would save you a lot of work.