From: Carl Trieloff <cctrieloff(a)redhat.com>
Date: Tue, 31 May 2011 15:13:09 -0400
> Can an object have more than one group tag?
It would need to from what I understand.
Just as with users, there need be no limit on what group tags are
applied to an obj. At call time, you'd run any matching user tag, any
matching group tag, then world. First match tells you your perms.
It's worth noting that if you wanted to implement acl-like negative
perms, ie "user X is denied launch access to object foo", you could
approximate that with tags containing null perms. Pretty sure that's
not a requirement for rev1, but is probably worth considering for the
model as a whole whether we want it to work that way. It impacts the
details of the algorithm used to implement the tests.