Control access to parts of a system, but also to certain pieces of information
This problem is not really new; it's basically the general problem of authorization and access rights/control.
In order to avoid having to model and maintain a complete graph of exactly what objects each user can access in each possible way, you have to make decisions (based on what your application does) about how to start reigning in the multiplicative scale factors. So first: where do users get their rights? If each user is individually assigned rights, you're going to pose a significant ongoig management challenge to whoever needs to add users, modify users, etc.
Perhaps users can get their rights from the groups they're members of. Now you have a scale factor that simplifies management and makes the system easier to understand. Changing a group changes the effective rights for all users who are members.
Now, what do these rights look like? It's still probably not wise to assign rights on a target object by object basis. Thus maybe rights should be thought of as a set of abstract "access cards".  Objects in the system can be marked as requiring "blue" access for read, "red" access for update, and "black" access for delete. Those abstract rights might be arranged in some sort of topology, such that having "black" access means you implicitly also have "red" and "blue", or maybe they're all disjoint; it's up to you and how your application has to work. (Note also that you may want to consider that object types — tables, if you like — may need their own access rules, at least for "create".
By introducing collection points in the graph pictures you draw relating actors in the system to objects they act upon, you can handle scale issues and keep the complexity of authorization under control. It's never easy, however, and often it's the case that voiced customer desires result in something that will never work out and never in fact achieve what the customer (thinks she) wants.
The implementation language doesn't have a lot to do with the architectural decisions you need to make.
This is a tricky question, we've been talking about this for a while (days) and haven't found a convincingly good solution. This is the situation:

We have users and groups. A user can belong to many groups (many to many relation)
There are certain parts of the site that need access control, but:
There are certain ROWS of certain tables that need access control, ie. a certain user (or certain group) should not be able to delete a certain row, but other rows of the same table could have a different permission setting for that user (or group)

Is there an easy way to acomplish this? Are we missing something?
We need to implement this in python (if that's any help).