I prefer the join table approach.

Having built one in the last few months, it gave me several good advantages, including an auditing sytem, the ability to set up expiration policies for permissions, the ability to develop a authorization groups, and great flexibility in adding new types of permissions for things.

The bitmap has a speed and space advantage. But the join approach is vastly more flexible, and that has worked out very well for me.