But the problem is, permissions are actually a representation of business processes snd communication structures. They are rarely user <-> role <-> permissions

But the problem is, permissions are actually a representation of business processes snd communication structures. They are rarely user <-> role <-> permissions (I wish they were!). Thats true. For us this was about coupling authorization with an authentication system so that developers could have both with a single product.