I hope this is the correct SE site for this kind of question.
My team is currently developing an application which IMO needs access control beyond RBAC. Users can have access rights to entities based on several factors e.g. the administrator of a company is implicitly granted admin access to subsidiaries.
To allow abstraction from this complex, domain specific access control logic on the resource level we are planning to put a service in place which will simplify this to (subject,object,permission) queries.
My first question is: Do you think this is a valid approach or would you place more domain-specific checks inside the resource/controller layer of the application?
Assuming that we do put the abstraction layer in place the second part of my question is as follows: Should we store all the implicit and explicit access rights in the access control for quick retrieval or rather have the system calculate implicit/derived permissions on the fly?
If we do the computation during write/update and only store explicit permissions we can then use some standard implementation like Shiro to handle the checks. If we do the computation on retrieval we will have to basically code everything our self.
On one hand I'm a bit reluctant to do a lot of computation for each request. But I'm way more afraid of having stale access rights (either false positive when forgetting to delete implicit grants or false negative when forgetting to update on change in corporation structure).
So where do you recommend to put the domain knowledge?