Need help designing an Access Control List (ACL) database structure
I favor computing and materializing granular object access entitlements so they are simple and cheap for the database to enforce at runtime.  And to simplify the relational model.

Order(OrderId, ...)
Order_AccessControl(OrderId, GroupID, AccessType)


Every time you create a group or an order you would generate the AccessControl entries using (potentially complex) business logic and configuration data, but storing, auditing and enforcing the security is simple.