Let's say you have a permission system with which you can specify things like: user U is a member of group A, which is a subgroup of group B, which is a subgroup of group C, and all members of group C have access to object O. Then, you can query the system like: "does user U have access to object O"?
As far as I can tell, this is a reachability problem, where the vertices are users, groups, and objects, and an edge implies direct access. However, I don't think that most large-scale permission systems frame this as a reachability problem because the only fast reachability algorithms are restricted to planar graphs.
How are these systems usually designed?