in this third embodiment, access control for a particular user on a particular managed object is defined by a permissions table or tables 406.
The present invention has an access Grant table 408 and an access Deny table 410.