I'm beginning to work on a new web app for which I require implementing Role-Based Access Control.
I've identified three Roles for my application which will be Role 1, Role 2 and an Role 3. Each user will be in one of these groups or can be in multiple groups as well.
Going down further, each role has 2 functionalities associated with them, say (D1, D2), (T1, T2) and (A1, A2) respectively.
Implementing access control up to this point seems fairly straightforward to me.
However, there are further drill downs for each role based on say geographical locations and another category called Accounts(S1, S2 and S3). For example, a Role 1 user will be having access to D1 and D2 but he should have access to only North America data and Accounts S1 and S2 but not S3.
This is the place where I'm at an impasse. I'm not able to put these sub-categories in my access control permissions because the permutations would be huge.
Any suggestions to implement this would be of great help.