For "access control layer" to work in the general case we need to be able to code it in a real programming language, no? Or are you going for something one-size-fits-many like Sharepoint?