title: Using Spring ACL in a complicated access setup for an entity
body: <p>I am developing a spring boot application with <code>spring-data-rest</code> being one of the core dependencies. As such, in order to secure the auto generated and manual endpoints I have been using a role based approach and a custom <code>PermissionEvaluator</code> to handle object specific auth checks. This works but is too cumbersome and fails when I need a filtered and paginated response. So, I am planning to implement ACL. Now, I have a rather complicated flow of authorisation for an entity.</p>
  
  <p>The users are mapped to a profile entity(MANY TO MANY). The <code>target</code> entity is also mapped to a separate profile entity(MANY TO MANY) and these 2 profile entities are mapped to each other(MANY TO MANY). To check if a particular user has permission over a <code>target</code> entity object, I need to go through the relationships in my application logic, in my <code>PermissionEvaluator</code>.</p>
  
  <p>Now, if I decide to implement this in ACL only, I am confused as to how to best to do this. The preliminary idea that I had is to create the object list directly in the ACL tables for each user(principle). This would mean that I would need to update the ACL tables everytime with new objects if a permission is changed. Is this a correct approach? Is there a better way to do this? Is it even ok to modify the ACL tables frequently?</p>
  
  <p>Summary: If the logic to check if a user has access over an object is complicated and requires data from other tables, how do I handle it efficiently using ACL?</p>