title: Managing the inherence permission on ABAC
body: <p>I have some questions when applying ABAC:</p>
  <ol>
  <li>What is the best way for managing the inherence permission for both subject and object hierarchy In the ABAC model?</li>
  </ol>
  <p>An example of this hierarchy: one of the rules for User U1 can access object O1 is: User U1 who belongs to group G1 (group G1 belongs to G2 and so on) wants to access object O1 which belongs to Container C1, C2...Cn(up to 1k). The rule is if one of G(n) can access C(n) then U1 can access O1.</p>
  <p>One possible solution I think is to use reference policies or flatten relationships but checking sequentially for each container or group will impact the performance. How should I handle this?</p>
  <ol start="2">
  <li><p>What is the good way to manage policy, should we attach policies to Subjects, Objects or it should be generic rules only.</p>
  </li>
  <li><p>Why is Access Control Models unpopularity compare to other software models?</p>
  </li>
  </ol>