It sounds like you're thinking of proper object ACLs, which get pretty complex quickly--see Spring domain object security, Windows / NTFS / Active Directory DAC

It sounds like you're thinking of proper object ACLs, which get pretty complex quickly--see Spring domain object security, Windows / NTFS / Active Directory DACLs, or the often-challenging permission system in AWS. These draw in some common ideas like having a taxonomy to identify the principal and security context, the target of the operation, the operation itself, the object's security parent, whether or not ACEs can be inherited from the parent, and whether to audit success and/or failure conditions.