Question: Is there any standard model or industry defacto implementation for modeling and implementing Access Control in (i.e.) a Document Management System?
Note: I studied a bit the security mechanism of Windows (which I do not want to use), and I saw Users and Groups and Policies.
But I can't understand:
1 - How a single policy object can contain all information about allowed/denied actions on a subject for all users and groups, at a specific moment of time.
2 - How multiple policies on a specific subject, merge into one to provide least possible access.
3 - What is the mechanism (data structures, database, caching, implementation) of hierarchical resources like folders? Those king of queries are usually slow.