I'm working on an application that needs access control. Basically, the problem I'm facing is this (heavily simplified):

The application has two main sections: 

1. **Files** = `File[]`
2. **Contacts** = `Contact[]`

A `File` resource can have many contacts assigned to it. Conversely, a `Contact` resource can be assigned to many files. 

What I want to do is create three roles:

1. > 
> **Clerk**: 
> 
> 
> 
> 	* has `create`, `read`, and `update` permissions, scoped to the **Files** section.
> 	* does not have access to **Contacts** section (i.e. can't `create`, `read`, `update`, or `destroy`)
>
2. > 
> **Contact manager**:
> 
> 
> 
> 	* has `create`, `read`, `update`, and `destroy` permissions, scoped to the **Contacts** section
> 	* does not have access to **Files** section (i.e. can't `create`, `read`, `update`, or `destroy`)
>
3. > 
> **Admin**:
> 
> 
> 
> 	* has `create`, `read`, `update`, and `destroy` permissions, scoped to **Files** and **Contacts** section.
>

For the third role (Admin), I see no conflicts. The first issue arises when a Contact Manager wants to destroy a Contact resource that is linked to a File resource (that, as a Contact Manager, he/she doesn't have access to).

In addition, I'd like to take the roles one step further, and for example give them certain `CRUD` permissions for **Files** as well as **Contacts**, but have a scope within **Files** and within **Contact** (e.g. permissions apply to Files of type X, and Contacts of type Y). 

Then other issues start arising: what if a certain role destroys a Contact, that is linked to a File that the role does not have access to? What if a role has access to a subset of Files, and a subset of Contacts, but one of the Files the role has access to, has Contacts linked to it that the role does not have access to?

Is there an elegant way to solve this using the RBAC model? I've also looked into ARBAC, but it seems like overkill for a relatively simple application. To me, it seems that the root of all the issues is the many-to-many relationship between Files and Contacts. 

Are there specific ways to deal with a situation like this? I'm fairly new to this, and these permissions just landed in my lap for this project. I've looked into several Access Control models (even [OrBAC](https://pdfs.semanticscholar.org/b1a6/35d2360c3ea0ebd28e1ab86c6e46cb5e9566.pdf)), but none seem to be able to address this issue.

Any help or hints in to the right direction would be greatly appreciated.