Question about ACL

It's really not that hard to make user, group, and permission models, then tie them together with group_permission and group_user models.