db tables should be linked-to/qualified-by organization, group, project
Each table row should have view/update/delete security and each table should have "add" security (probably identical to update security).
How to share resources (e.g. database connections, socket connections, etc.) across plug-ins? And how to manage the lifetime of shared resources?
Why is it that so many of us want to make a workflow system? I think it's because on the surface workflow systems sound easy to build. But as you get further into the details, and look at the features that are actually provided by commercial workflow vendors, it's not easy at all.