title: Multiple levels of authorization, not only role-based
body: <p>Our application uses multiple ways for authorizing access to a given resource. Although it's working, it's messy and... well, it doesn't seem right.</p>
  <h3>1) Role-based authorization</h3>
  <p>We have well defined roles where each role has access to a set of the resources and different roles can access the same resources.</p>
  <p>Resources, as of now, are simply MVC actions mapped in a database table as <code>module</code>, <code>controller</code> and <code>action</code>.</p>
  <p>This seems to be OK, but every time I need to add a new controller/action I have to map this resource to the database table.</p>
  <h3>2) User-based authorization</h3>
  <p>Besides role-based authorization, users can have more or less access to a subset of resources of another role. <strong>Eg.:</strong></p>
  <p><strong>RoleA</strong>: resources <em>a</em>, <em>b</em>, <em>c</em>, <em>d</em><br />
  <strong>RoleB</strong>: resources <em>x</em>, <em>y</em>, <em>z</em><br />
  <strong>RoleC</strong>: resources <em>1</em>, <em>2</em>, <em>3</em><br />
  <strong>User1</strong>: has <strong>RoleA</strong> but needs to access resource <em>y</em><br />
  <strong>User2</strong>: has <strong>RoleB</strong> and <strong>RoleC</strong> but does not have access to resource <em>z</em></p>
  <p>This is implemented as an <code>user_resources</code> table with entries for additional resources that the user has access or is denied (indicated by a flag).</p>
  <p>I could create different roles with tailored access, treating roles as group of permissions, but that would lead to a roles explosion.</p>
  <h3>3) Model state authorization</h3>
  <p>If that's not enough, some actions can only be performed when the model is in a certain state (each model knows when something can be done). <strong>Eg.:</strong> an order can only be edited if the user has access to the <em>edit</em> resource (through steps #1 or #2) and the object <code>Order</code> can be edited.</p>
  <p><strong>Anoter example:</strong> an user can access a <code>Customer</code> if he has access to <code>/customer/view</code> resource and he <em>owns</em> that Customer (he is the contact info for that customer).</p>
  <h3>4) Display information in UI</h3>
  <p>A role, group of roles or individual users can see more or less information about a model, depending on it's state.</p>
  <p>How can I simplify this authorization process without loosing flexibility in giving or restraining access to resources?</p>
  <p>There is any pattern I'm missing here to unify all this authorization in a single place?</p>