I guess it depends on what you want to do. Now and then I need to authenticate users and check for their privileges to access my applications. Now and then I need to see who has what privileges on what applications. These both sound to me like cases where one could use a database. Maybe I don't care how the stuff is stored, but the relational model is very handy.