I want to implement a security system into my web-based Intranet application which allows security administrators to 'fine-tune' exactly what type of access a user/role has to an object. For example, an ACL-based solution might allow a receptionist access to
Update an appointment but not
Delete it, similarly I might be able to let user Bob only
Comment on a company memo, but not
However, how would I go about allowing a receptionist only to make appointments within opening hours? How would I restrict appointments to dates from today to one month from now? What about Bob - how would I let him
Create a memo after he had gained enough 'respect' points (a bit like on here).
Crucially, how can I keep these values dynamic (opening hours, date restrictions, respect points, some new constraint) so that I don't hard-code them into the application? Can anyone recommend a method (or framework, book to read etc) so that I can let the administrator create and manage these roles and their constraints rather than the programmer?
The existing ACL and role-based systems I've seen don't seem to offer any way to deal with constraints - you either have access or you don't!