Methodologies for Managing Users and Access?

This is something I’m having a hard time getting my head around. I think I might be making it more complicated than it is.

What kind of permission is this? (Groups+Roles)

I’m starting to need an access control for roles in my app.

Should I manage authentication on my own if the alternative is very low in usability and I am already managing roles?

As a small in-house dev department, we only have experience with developing applications for our intranet. We use the existing Active Directory for user account management. It contains the accounts of all company employees and many (but not all) of the business partners we have a cooperation with.

How to implement a hybrid role-based access control model?

I am writing an enterprise web-forms-frontend application for in-house use. It has Direct access control (DAC) masquerading as Role-based access control (RBAC).

What is the nicest (user-friendliest) way to tell a user about “Access Denied” error?

Our software implements a layer of role-based security to secure data access, in the form of access control lists. Whenever a user tries to do something that isn’t allowed, the software layer will receive an “access denied” error code or exception.

Using a Finite State Machine for access management?

My intranet site uses LDAP and Active Directory to authenticate users. There are 2 kinds of Users: Managers and Employees. They are differentiated by having membership in a particular AD group.

Restrictive routing best practices for Google App Engine with python?

Say I have a simple structure:

Restrictive routing best practices for Google App Engine with python?

Say I have a simple structure:

Restrictive routing best practices for Google App Engine with python?

Say I have a simple structure:

Using a Proxy as an ACL

I am building an MVC application in PHP, using Zend Framework.