[georgemcbay]

"create bullet proof models"

Assuming that is possible (for anything but the most simplistic of systems) is likely the root of your problem.

[rafweverbergh]

I thought this might be ambitious, yes. Although at this time the system is (still) really quite simple.

Also, I thought: there must be a better way than saying: "So when user A logs in and merges records X and Y, user B will see the changes but not user C because he's not an admin".

But apparently I am mistaken?

[RollAHardSix]

I'd wager you just aren't being clear enough. From what you just said, I have zero context as to why user B can see those changes. I can make a guess, because he's an admin, but it's just that, a guess based on the little context you provided about user C not being an admin and being unable to see the changes.