1. A method of controlling access to computer system resources based on permissions, comprising: receiving a request for access to a computer system resource; determining if a superclass permission of a required permission is present in each protection domain of an access control context, wherein the superclass permission is a super class of the required permission; adding the required permission to a permission collection if the superclass permission of the required permission is present in each protection domain of the access control context; and granting access to the resource if the superclass permission of the required permission is present in each protection domain of the access control context; wherein adding the required permission to a permission collection includes creating a new permission collection and adding the required permission to the new permission collection; and wherein the adding the required permission to a permission collection further includes adding any subclass permissions of the required permission to the new permission collection.