1. A method comprising: receiving an entitlement request from a downstream access control system seeking an entitlement permission, the downstream access control system seeking the entitlement permission on behalf of one or more of the following: a user, a group of users, all users associated with the downstream access control system, and the downstream access control system; retrieving entitlement rules and roles from a metadata repository; matching the entitlement request against the entitlement rules and roles; and granting the entitlement permission when the entitlement request satisfies the entitlement rules and roles.