*** a/src/backend/catalog/aclchk.c
--- b/src/backend/catalog/aclchk.c
***************
*** 133,138 **** static AclMode restrict_and_check_grant(bool is_grant, AclMode avail_goptions,
--- 133,142 ----
  static AclMode pg_aclmask(AclObjectKind objkind, Oid table_oid, AttrNumber attnum,
  		   Oid roleid, AclMode mask, AclMaskHow how);
  
+ /*
+  * External security provider hooks
+  */
+ check_relation_privileges_hook_type check_relation_privileges_hook = NULL;
  
  #ifdef ACLDEBUG
  static void
*** a/src/backend/executor/execMain.c
--- b/src/backend/executor/execMain.c
***************
*** 416,421 **** ExecCheckRTPerms(List *rangeTable)
--- 416,428 ----
  	{
  		ExecCheckRTEPerms((RangeTblEntry *) lfirst(l));
  	}
+ 	/*
+ 	 * If available, it also invokes an external security provider. In this
+ 	 * case, both of the default PG checks and the external checks have to
+ 	 * allow the required accesses on the relation
+ 	 */
+ 	if (check_relation_privileges_hook)
+ 		(*check_relation_privileges_hook)(rangeTable, true);
  }
  
  /*
*** a/src/include/utils/acl.h
--- b/src/include/utils/acl.h
***************
*** 196,201 **** typedef enum AclObjectKind
--- 196,216 ----
  	MAX_ACL_KIND				/* MUST BE LAST */
  } AclObjectKind;
  
+ /*
+  * External security provider hooks
+  */
+ 
+ /*
+  * check_relation_privileges_hook
+  *  It allows an ESP to get control on dml permission checks.
+  *  A list of RangeTblEntry to be referenced and a flag to inform preferable
+  *  bahavior on access violations.
+  *  The ESP shall return ACLCHECK_OK if it allows the required access.
+  *  Elsewhere, it raises an error or return other AclResult status depending
+  *  on the given flag.
+  */
+ typedef AclResult (*check_relation_privileges_hook_type)(List *, bool);
+ extern PGDLLIMPORT check_relation_privileges_hook_type check_relation_privileges_hook;
  
  /*
   * routines used internally