I'm in the process of designing the access control portion of a moderately complex application, but I feel like I'm re-discovering a lot of wheels.
Does there exist a good overview of the "access control" domain, including terminology, discussion of the tradeoffs of different schemes (RBAC, ACL, ???), how it interacts with business policy ("Alice can only access the coffee machine before 11:30"), and possibly implementation suggestions?
Sorry if this question is a bit vague. I'm still in the "I sort of know what I want to accomplish, but I don't know very much about the domain or terminology".