Design: How to handle user permissions across a system

My team is currently working on a massive refactor of a medium-sized application in PHP. We are doing our best to refactor our code on a module (Orders, Users, Products) basis. The issue that I am currently wondering about has to do with handling what a user is allowed to do on our system.

Dynamic Code Evaluation in Java – Clever or Sloppy?

I am trying to create a flexible ACL framework in Java for my application.

Dynamic Code Evaluation in Java – Clever or Sloppy?

I am trying to create a flexible ACL framework in Java for my application.

Dynamic Code Evaluation in Java – Clever or Sloppy?

I am trying to create a flexible ACL framework in Java for my application.

Dynamic Code Evaluation in Java – Clever or Sloppy?

I am trying to create a flexible ACL framework in Java for my application.

Dynamic Code Evaluation in Java – Clever or Sloppy?

I am trying to create a flexible ACL framework in Java for my application.

Check permissions on top layer before going deeper

I’m building a four layer simple architecture with the following layers:

How to handle complex logic, avoiding recalculation for performance reasons?

let’s say we’re building an Ecommerce Marketplace.