The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access rights against them. Then assign the users the roles.
Though I find the role based method quite flexible and easy to maintain I am still interested to know whether there are any better methods for storing authorization details.
I am using Spring Security for securing JSF web applications. Along with solutions for Spring Security I would also appreciate general solutions (not specific to a particular security framework).