title: Symfony2 ACL combined with another criteria
body: <p>I'm wondering if anyone knows of an elegant way to achieve this using the Symfony2 ACL system.</p>
  
  <p>I have a <code>Comment</code> entity (my domain object) which needs to be editable by <code>ROLE_USER</code> but this is only allowed within 5 minutes of the comment being posted - otherwise the comment can only be edited by <code>ROLE_ADMIN</code>.</p>
  
  <p>Making it so that it can only be edited by <code>ROLE_USER</code> and <code>ROLE_ADMIN</code> is simple, just make a <code>RoleSecurityIdentity</code> for each.</p>
  
  <p>Now my problem occurs when I want to incorporate the time factor for <code>ROLE_USER</code>. My first problem is that it needs information from the domain object, not just the ACL table but I think this is solvable by making a custom <code>ObjectIdentity</code> class which can also hold the time that the <code>Comment</code> was posted.</p>
  
  <p><strong>Now for the hard part</strong></p>
  
  <p>I think I need to create a custom <code>PermissionGrantingStrategy</code> that knows to also look at the creation time. This has to be loaded when a <code>Comment</code> type is being checked, but I don't know how to get it to load. Does anyone know if there's some kind of factory through which this sort of thing can be configured? So that if an entity has a specific <code>PermissionGrantingStrategy</code> associated with it then it gets used otherwise the default is used?</p>
  
  <p>I know this is a bit of a long one, many thanks if anyone knows how to achieve this as the ACL documentation seems a tad sparse at the moment. My fallback solution is to simply make some kind of service to check if a Comment can be edited and not bother with ACL at all.</p>