1. A computer-implemented method comprising: storing data corresponding to a plurality of roles, a plurality of document types, and a plurality of permissions, wherein each role includes a plurality of users assigned to the corresponding role, wherein each document type is associated with a plurality documents having a lease one common characteristic, and wherein permissions specify authorization to perform particular actions based on said roles and said document types, and wherein the roles, documents types, and permissions are related according to a three-dimensional model; converting the three-dimensional model into a plurality of two-dimensional models, the plurality of two-dimensional models comprising a first model having rows of users from each role and columns of document types, a second model having rows of documents from the document types and columns of roles, and a third model having rows of tuples comprising users and documents and columns of permissions, wherein an element at an intersection of a row and column specifies access rights between users, documents, and permissions; and generating constraints from the two-dimensional models to define access rights in a computer system.