A RBAC model, plus concepts such as User Group, Permission and Scope.