there's also the question of decision vs enforcement, where decision is whether the user has a permission on a given object, and enforcement is what you do with that information