Formally modelling and describing access rights
The Harrison-Ruzzo-Ullman model has this form.  It has principals (e.g., users) and objects (e.g., files), and a matrix that indicates which types of access each principal has for each object.  It also models how the sets of access rights can evolve over time.  It has no notion of hierarchy for principals or objects built into the model, but you could of course regard the set of principals and objects as hierarchical in the way you want -- that's compatible with the HRU model.

The HRU model concerns itself only with semantics: with who has access to what.  It is not concerned with efficiency.

You might also enjoy digging up a textbook that covers this.  The catchphrase you want is the foundations of computer security".  For instance, you might find Matt Bishop's book Computer Security: Art and Science very relevant.