In our user-rights management system we basically follow "CRUD", where at each incoming request the user is checked against his rights, and see if he has create, read update or destroy rights for the data he wishes to access.
This system is created by my predecessor, however I'm constantly in doubt if this is the right system to use. Say I have an "admin" user, which is below the "rootadmin" - admins can modify the accounts but not the server itself. Rootadmin could do anything, including resetting the whole server and other such fun things.
However since it can modify user accounts it has UPDATE access on the "role-field" of a user, and could update any user to any level, including "rootadmin". So it seems simple CRUD is not enough.
Another example (to make it clear that this is a case that's not unique to rootadmin privileges):
An employee is given rights to update the production status of "items". However each employee works only in a part of the full company: so he shouldn't given rights to update (or read) items that are outside his production line.
Is there a well known method to handle user rights, in a generalized system? Or does everyone roll his own implementation for each application a new set of rules?
My only solution so far is to store "lambdas" in the database, where together with the right, there is a "limitation". It would then read: "user X has right Y (update field A in B) but only if lambda Z is returns true.
However this would either make the database really language dependent, and store raw code on the database. Or one would have to write another layer to interpret some kind of dsl.