we use a bitmask to store permissions on an ACL… works very well. We can aggregate the permissions using bitwise operators to build aggregated permissions for users who have multiple roles in our system.