Role-based access control like it was meant to be
Maybe a really dumb question, but wouldn't the least complex way of doing something like this be to just attach the ACLs to folders instead of files/objects?<p>So if you want to grant access to reports to a role, you would set the ACLs on the reports folder, not on individual reports.<p>Object-level permissions feels too fine-grained for me in many cases. We probably need this for actual file systems, but those are quite different from something like an enterprise application. The file system has lots of "irrelevant" files for the user that might need specific permissions, and you can't arbitrarily reorganize files without breaking stuff.