There are different kinds of ACLs I've generally implemented:
- Does a user have access to a resourcetype(API)?
- Does a user have access to a resource(Object)?
- Does a resource have access to another resource?
- Is a resourcetype supported for a resource?
- Restrict outcome of one metaresoucetype(Seach) based on restrictions on resourcetype.
Except for 1, everything has generally been modeled at the application layer, while (1) is answered by traditional authn/authz mechanisms. This grows immensely complex as the types of resources and resources themselves increase. Since these questions are quite similar, is there a good way to model a general purpose solution to the above class of problems? If so, what are some well known implementations/architectures?