1. A user authorization system comprising: a database server including a database management system that manages a database, the database server maintaining, in the database, a cached user rights list as a cached transitive closure and an access control list for a set of objects, the database embodied on non-transitory computer memory, the user rights list comprising user rights records of associations between users and related entities from which the users inherit rights and the access control list specifying permissions of entities to access the set of objects; and an authorization server coupled to the database server via a network, the authorization server comprising a processor and a memory and configured to: receive a request from a user for an object; and interact with the database server to cause the database server to perform: determining a new transitive closure for the user based on a directed graph of associations between entities in the database; determining a delete user rights record by: comparing the cached user rights list and the new transitive closure; determining a first transitive closure path for an entity that is not specified in the new transitive closure and that is specified in the cached user rights list; and selecting as the delete user rights record a record specifying the first transitive closure path; and deleting the delete user rights record from the cached user rights list.