"create bullet proof models"
Assuming that is possible (for anything but the most simplistic of systems) is likely the root of your problem.
Assuming that is possible (for anything but the most simplistic of systems) is likely the root of your problem.
Also, I thought: there must be a better way than saying: "So when user A logs in and merges records X and Y, user B will see the changes but not user C because he's not an admin".
But apparently I am mistaken?