Fellow Monks
Having maintained (hacked) an RT system for some years now, I have come to respect it's group and user 'Rights' model of access control.

I seek the collective wisdom for suggestions regarding implementing similar controls in a more generic way for example.

my $user = App::User->load( $someid );

if ($user->can_modify) {
    $app->modify_document( \%args );
}
else {
    $app->error( 'Access denied: you are not allowed to modify documen
+ts' );
}
[download]

My goal is to provide more granular control over user's rights in a web application context, rather than a rudimentary Admin/User distinction where admins can do anything and users only basic things.

Update : Data::ACL looks like a candidate.
Decision::ACL somewhat more sophisticated.

Update : Ammended links above as CPAN, thanks cazz.