At the moment I am building a toy PHP framework where you must pass a user into the service/business layer that will go all the way up to the data access layer.

At the moment I am building a toy PHP framework where you must pass a user into the service/business layer that will go all the way up to the data access layer. In my opinion authorization should be done at read/write level because then all layers will benefit from the same authorization security. It seems Oso is doing just that, which is great. In fact this is how linux/unix has been working for years. But on the internet sometimes it feels like every wheel is being reinvented. Most frameworks behave as if you would open a file in Word and then Word will decide if you are authorized to view or edit the file.