1. A user authorization system comprising: a database server maintaining a cached user rights list and an access control list in a database embodied on non-transitory computer memory, the user rights list comprising associations between users and related entities from which the users inherit rights and the access control list specifying permissions of entities to access objects; and an authorization server coupled to the database server via a network, the authorization server configured to: receive a request from a user; and interact with the database server to cause the database server to perform: determining a new transitive closure for the user based on a directed graph of associations between entities in the database; determining a delete user rights record by: comparing the cached user rights list and the new transitive closure; determining a first transitive closure path for an entity that is not specified in the new transitive closure and that is specified in the user rights list; and selecting as the delete user rights record a record specifying the first transitive closure path; and deleting the delete user rights record from the cached user rights list.