title: Rails 3: Project-based permissions
body: <p>I am building an internal project management software (ala Basecamp) that will be for our internal and external use. I am struggling to find the best strategy for doing advanced permissions though.</p>
  
  <p>Like Basecamp, there will be a number of clients, with a number of projects under them. I want to be able to assign each user different viewing rights to each client and project, which will dictate who can see what. Basically, an admin should be able to say "this user can see these 4 projects", and then when that user logs in, they are presented with those 4.</p>
  
  <p>I am using Cancan for overall permissions, but this does not appear to be able to assign in the way I need. I've looked at role_model, cantango, et. but can't find a use case that fits exactly what I am trying to do, even though it seems quite standard. </p>
  
  <p>Any insight here?</p>
  
  <p>Thanks!</p>
  
  <p>Edit:</p>
  
  <p>It has obviously occurred to me to just do a permissions table (described here: <a href="https://stackoverflow.com/questions/1029648/how-to-create-a-basic-user-permissions-per-project-association">How to create a basic User Permissions per project association?</a>). I struggle with a) is this the best way? and more importantly b) what is the best way to check permissions in the app and only show allowed data?</p>