TL;DR:I am looking for theoretical sources about the different manners to implement user access control.Long versionI have almost finished all the stand-alone tools needed in my CMS.I am not at the moment where I need to bring all these pieces together.Now what I would like to is to create a CMS (and an API) that is completely user-centric.This means a very strong, yet easy to use, rights management framework at the base of everything. A bit like unix/linux filesystems work (not the actual implementation, but in the sense that they are at the very core of the system).This framework would need to account for special cases (user can access this data until date x), and implement per-action, or per-item rights (user can edit articles, but not article233), be completely abstract (not tied to any particular database), and not tied to any authentication system. Also, since any request would go through it, it needs to be quite optimized. Lastly, I want to keep it open for modularity.This is quite a large project, and before getting into it, I'd like to gather as much theory about used rights management. I know about ACL (and have already implemented a few custom systems myself), but I am looking for a more abstract, high-level document, ideally, not tied to a particular language. In the article/book I envision, code samples would be rare, a few lines only, and coded in pseudo-code just to illustrate a point.I've been looking on the net but can only find tutorials about how to implement ACL, or discussions about role-based access control, but nothing about, say, research in the field, innovative/alternative solutions, etc.Anyone can advise a good book/webpage/resource about that?
Theory of user control systems?
relational structures
I can't help you with your CMS, but a very good place to read about the logic of access control is Deepak Garg's PhD thesis, Proof Theory for Authorization Logic and Its Application to a Practical File System.