I am sorry for not posting any code. I am stuck at the design phase -that's why-
What I want to accomplish is: allowing system administrators of a 'Staff Task System' to dynamically set rights to a specific user/department to a specific action in run-time.
The rights are complicated. For example: They can restrict task assignment to employees, if User is the manager of the user's receiving the assignment. Also this manager can only view tasks if within same department and same location. Sometimes a task can require more than one person to approve and I don't only need to authorise these specific users dynamically, but also mark the task as approved after those specific users approved the task.
The above is just to give you an idea of what I am trying to implement. I am seeking an advice on the design-pattern/framework/direction to start implementing something like the above.
I am sure role-based is not the right answer. I started exploring Claim-Based authorization from .NET Identity but I didn't see much examples or tutorials on it.