title: Cake's ACL component and the concept of "ownership"
body: <p>I have been futzing around with Cake's Auth/ACL components.  I've read the docs and I've done the tutorial, but I am still not satisfied with what I can actually accomplish with it.  I've seen a <a href="http://aidanlister.com/2009/05/implementing-row-level-access-control-in-cakephp/" rel="nofollow noreferrer">couple</a> of <a href="http://jmcneese.wordpress.com/2010/01/28/rmac-is-dead-long-live-rmac/" rel="nofollow noreferrer">other</a> approaches, but I can't say as I really have a straight winner with either.  In any tutorial/blog post/doc I read, the use case of "ownership" isn't exactly sufficiently covered.  </p>
  
  <p>I was hoping to describe my use case and If there's anyone that can suggest an approach, I am all ears, otherwise I might just have to try to do something myself ;o)</p>
  
  <hr>
  
  <p>This basically mimics a simple set of Dr's offices.</p>
  
  <p><em>Starts out easy enough for AROs:</em></p>
  
  <ul>
  <li>Group 1: administrators (of course)</li>
  <li>Group 2: caretakers </li>
  <li>Group 3: members</li>
  </ul>
  
  <p>There is a "hasOne" relationship between groups and users (i.e. a user can only belong to one group).  </p>
  
  <p><em>Now we use a tree structured ACO like <a href="http://aidanlister.com/2009/05/implementing-row-level-access-control-in-cakephp/" rel="nofollow noreferrer">Aidan Lister considers</a>:</em></p>
  
  <pre><code>/root
      /practice
          /practice_profile
          /practice_updates
          /patients
              /entries
              /profiles
              /other_things
  </code></pre>
  
  <p>Each caretaker will have access to a practice that includes his patients.  This gives the caretaker access to anything that the patient writes.  On top of this, the patient will <strong>ONLY</strong> be able to see/edit/etc... anything that he owns.  This wasn't specifically covered in any writing that I have read.  I know that with filesystem types of permissions this is commonplace, but I don't even want to go down that road...</p>
  
  <p>With Auth/ACL in Cake's core, it doesn't really get into permissions like this.  It seems to say "well, if you're part of group X then you can perform function Y."  Therefore, it seems like any user that belongs to the <code>members</code> group would have access to all other members' content and all <code>caretakers</code> would have access to all practices.</p>
  
  <p>Has anyone else come across this sort of use case?  Any suggestions for further reading?  Any known solutions?</p>
  
  <p>EDIT:  So all of the answers were great, so upvotes all around.  I highly recommend looking at the post that I didn't find, supplied by bancer as it ended up pointing me to some cool things.  Ultimately, though, the answers were buried in the docs, I just didn't quite "get it" the first time around.  Also, there was an AHA moment when I read the <a href="http://cakeqs.org/eng/questions/view/how_to_do_row-level_access_control" rel="nofollow noreferrer">cakeqs</a> link.  So answer goes to Benjamin.  </p>