Couple of admin Qs

As many of you have done these things already (and yes, I have to dig further into the docs...)

- Is there a privileges incantation which will limit a user's view, within a given cluster, to only those databases to which he can connect?  Ie, he'd see only the 3 or 4 databases to which he has privileges?  Does the privileges model permit this level of granularity?

- Can someone point to an example of how to 'trigger' an event when a user logs on/off, or performs other non-data-touching actions, such as connecting to another database?  Can't build a trigger on a function call, right?  Has to be based on a data change?

Tks in advance - Lou