I have the following use-case: employees usually have access to all cases in CiviCRM, but occasionally there can be a sensitive case that must only be visible to users with a higher permission level.
I looked at CiviCRM ACLs, but they do not seem to apply to Cases. I also found an old make-it-happen campaign but I don't think it happened.
I'm tempted to create an extension that adds a "confidentiality" custom field to cases, which would restrict access to the case itself, as well as to the case activities. I might not be able to alter the queries for listings (search cases, search activities), but if the subject itself is not confidential, it would be an acceptable compromise (and eventually we can introduce hooks in those listings, if necessary).
Has anyone ever done this? Any other solutions?