Example of permissions bitmask:

...
use constant READ_PERM => 0x04;
use constant WRITE_PERM => 0x02;
use constant EXECUTE_PERM => 0x01;
use constant NO_PERM => 0x00;

my $allowed_perms = READ_PERM | WRITE_PERM;

# Check for permissions:
if ( $allowd_perms == NO_PERM )
{
    print "PERMISSION DENIED\n"
    exit -1;
}

if ( $allowed_perms & READ_PERM )
    print "READ Allowed\n";

if ( $allowed_perms & WRITE_PERM )
    print "WRITE Allowed";

if ( $allowed_perms & EXECUTE_PERM )
    print "EXECUTE Allowd\n";

...
[download]

This method requires that we have 1 bit for every permission across the entire system. Thus a system with 256 distinct permissions will represent the integer 1.15792089237316e+77. To assign a user a permissinos mask we bitwise OR the permissions bits together. To check for a particular permission in the mask we bitwise AND the permission bit that we are looking for against the user's mask.
The pros:

• is very easy to use
• cheap to pass permissions around the in the system

The cons:

• size : A mysql BIGINT would only allow 64 unique permissions (there is a nasty workaround for this limitation involving stringification (yuck!))
• maintainability : MUCH care would need to be taken when adding new permissions to the system

The next approach is named permissions. This method implements permissions as a list of text tokens. For example:

use constant READ_PERM => READ_PERM
use constant WRITE_PERM => WRITE_PERM;
use constant EXECUTE_PERM => EXECUTE_PERM;

my @allowed_perms = (
    READ_PERM,
    EXECUTE_PERM
);

# Check permissions
if ( scalar(@allowed_perms) == 0 )
{
    print "PERMISSION DENIED\n";
    exit -1;
}

if ( grep { $_ == READ_PERM } @allowed_perms )
    print "READ Allowed\n";

if ( grep { $_ == WRITE_PERM } @allowed_perms )
    print "WRITE Allowed\n";

if ( grep { $_ == EXECUTE_PERM } @allowed_perms )
    print "EXECUTE Allowed\n";
[download]

The pros:

• Flexibility : This approach lends itself to namespacing and partitioning much easier than the bitmask method.
• Maintainability : Permissions aren't necessarily required to be defined in one location (given namespacing is in use)
• Allows components to add new permissions to the system without requiring a central registry or human intervention.

The cons:

• SIZE : A list of text tokens is much larger than a single integer.
• more difficult to use : in the since that we would probably use grep (or we could use exists if we put the permissions in a hash) either way we are using a function call as opposed to a simple logic operator