disclaimer: I am a co-founder of Aserto [0], an authorization platform for developers.
I think it would be awesome to explore how to grow the authorization model from a simple set of roles / permissions to a fine-grained model as the application matures.
