I'm looking to create a solution which determines record level access dependant on login. I have done this so far by creating a users db and a token so that users A, B & C can only view records with a corresponding letter in the owner field. This works fine, however, I also require a further user(D) to be able to view all records regardless of who the owner is. Would this require an if statement along the lines of "If owner is D -findall" or would it be better handled via the web security db?

If you want to do it on the same page, then the IF is OK.

It your search parameters are multiple like date and tokenvalue, maybe just blank token will do the search for all records.