Imagine a system which has a number of functions and a number of users. A user must have rights to a specific function. Users may belong to a group. A group may belong to a group.
So as a simple illustration, user A has rights to function 1 and 2. User b has rights to function 2 and 3.
User A is in group1 which has rights to function 3, but negative, i.e. explicit denied access to function 1.
For extra complexity, perhaps the function has default rights. So you can say, but default everyone has access to function a, or no one has access to function a. I guess it's the same as having an Everybody group.
So the question is how are you managing user rights? Do you make all rights additive? Do you allow the explicit denied I mention at the end? Do you have a system where the most access possible is granted or the least? Do you make user rights trump group rights, or vice versa?
I've seen a number of variations for applying rights. I'm now defining my own and I'm really looking for any experience you have in that area where you wish you'd done something different, or were delighted you chose a particular way of doing things.