Spring security additional rights on some entity <p>we have implemented a web application and use spring's pre-post-annotations to secure the access to some rights.</p> <p>At the moment it is quite simple. We have companies. You can have read/write/admin permission on a company.</p> <pre><code>public class Company { @Id private Long id; private String name; } </code></pre> <p>So we have the database tables user, company and of course the spring security tables acl_class, acl_entry, acl_object_identity and acl_sid.</p> <p>Now there are special entities underlying a company, let's say this is the employee.</p> <pre><code>public class Employee { @Id private Long id; private String name; private Company company; } </code></pre> <p>One company can have many employees and a employee can only be employed at one company.</p> <p>Now not every user may have read/right access onto a employee. The user must have a read/write/admin right to a company AND has to have a special right to read/write/admin the employee. So it is possible a user can have a write permission to company X but not even read access to company X's employees. A user may have only read access to company Y and write access to all employees of company Y.</p> <p>There shall be no further limitations on specific employees. Just all employees of one company.</p> <p>I actually don't want to manage dynamically all acl objects for every employee but be a little more dynamic. I'm thinking of something like a "permission flag", extending a base permission on a company-permission. Do you have an idea how I could solve this most elegant and easy?</p> <p>I didn't find a good example in the spring security documentation. Is this a bad practice?</p> <p>Thanks a lot for help :-)</p>