I'm working on the access control component of a complex web application. One of the goals is to have a strictly defined model for who can do what, but I can't find an existing model that meets our needs.
The problem is to define a system I can query with pairs of objects (typically a user and something else, but not necessarily) to find the appropriate level of access according to the application's structure. These 'objects' are - in my case - 'models' in an MVC-style webapp. Say one of the models is a blog, and another is an interest group of some sort; a blog can belong to a group, a user can belong to a blog or a group and group can belong to another group. A example of the sort of rules I want to use: 'a user can post comments on a blog if the user is a member of a group to which that blog belongs'; 'a user can view a blog if the user is a member of a group which itself is a member of a group to which the blog belongs', and so on.
These cases are easy enough to implement explicitly in code, but I'd like a formal model like RBAC and friends. Does such a thing exist? If not, is there a good reason why?
(Edited for - hopefully! - clarity)
Further edits for more clarity:
Courtesy of Dennis' link, a definition of RBAC:
Unlike ACLs, access to a resource is determined based on the relationship between the requester and the organization or owner in control of the resource; in other words, the requester’s role or function will determine whether access will be granted or denied.
In these terms, I'm interested in more complex 'relationship[s] between the requester and the organization ...', along with similar relationships between the organizations and resources of the system: rather than each resource having a list, set by its owner, saying 'such-and-such a role has such-and-such a level of access', I want the level of access to be determined by the (possibly complex) relationship between the user and the 'owner' and between the owner and the resource.
Conceptually I have a graph that includes users, organizations and resources, and I want the access control rules to be determined (in part) by the structure of that graph.
Edit: the sort of thing I'm talking about is quite similar to the 'policy predicates' in S4.2 of http://dspace.ucalgary.ca/bitstream/1880/47933/1/2010-959-08.pdf.