title: RBAC or ACL, for private content?
body: <p>Trying to build a micro-CMS (of sorts), which needs to dish out content i.e. images only, for the moment, to person logged in via a username/password.</p>
  
  <p>Let's say there can be 10K such users, and each user has about 100-1K images in their own account, which <em>no one else</em> should be able to view. What would be the recommended approach to building such a system ?</p>
  
  <p>My instincts tell me that ACL is the right approach, since the "roles" in my case are shared-nothing, so I'd have to create as many roles as users. Am I headed the right way ?</p>