Ben just pointed out to me that the above solution (linked to in the blog post) is bad because it causes Drupal to bypass any subsequent node.module code - which includes the bit where node.module sets the access for the node. So if you interrupt node.module during your nodeapi code then it will never set nodeaccess settings. =(