Lapis Commons contains a simple, but robust and extensible permissions system. See An Algebra of Permissions to see the 'theory' behind the permissions system.