Use db_rewrite_sql()

When a module makes an SQL query to the node, and taxonomy core tables, it should pass the query string to db_rewrite_sql() which allows other modules (including the core node.module module) to filter the list of nodes returned.
In the case of node.module, it filters out the nodes to which the current user has no access.