Best practices for designing your access control list

This guide is still a work in progress. Just a general word of warning:

danger

Avoid too deeply nested subject set indirections (more than ~5).