I have an authorization service in my firm that adds an additional dimension to the question. We have users, resources, actions and a fourth one called "environment" (env for short)