title: How to build a data model for an access control list (ACL)
body: <p>It's fairly obvious how to model a database table that would act as an access control list (ACL) when you're just dealing with discrete users who have some level of access to a discrete resource. Something like this:</p>
  
  <p><code>TABLE acl (
     user_id INT,
     resource_id INT,
     access_type INT
  )</code></p>
  
  <p>... where access_type is a number representing something like:</p>
  
  <p>0 (or lack of record for user_id and resource_id) means no access</p>
  
  <p>1 means read-only</p>
  
  <p>2 means full control</p>
  
  <p>However it starts getting trickier when you've got scenarios like users can be a member of one or more groups and groups can contain other groups. Then a resource could be a folder that contains other resources.</p>
  
  <p>Other than the obviously poor approach of doing a whole bunch of recursive queries at runtime to determine the level of access a user should have to a resource, how do these scenarios tend to get handled? Are there commonly-accepted designs for modelling an ACL like this?</p>