Semi-off topic: What is the latest and greatest in authorization mechanisms lately? I like capability-based at on OS level, but sadly I'm not doing anything th

Semi-off topic: What is the latest and greatest in authorization mechanisms lately? I like capability-based at on OS level, but sadly I'm not doing anything that interesting. For things like webapps, is there anything better than ACLs or Role-based. Or at least any literature talking about them? Probably overkill for the application I work on, but it'd be nice to take inspiration from best practices.