Ask YC: Best practices for implementing access control?

Hi I would like to implement some kind of access control. I already have user authentication built, and the next step is authorization. How would you do it? Any good articles discussing the security? Any good pointers about maintenance and administration? I've done some searches but I thought to ask hackers who probably have done this. Thanks!