Access Control List pattern?

Is there a general use pattern and implementation for user authorization
everyone uses with Barracuda? The example HR application in the Barracuda
vs. Struts paper is close to what I would like to do.

I was hoping to be able to use an LDAP server to store my ACLs, but I can
only use it for authentication purposes. This leaves me to implement my own
access control list in the database which will determine which users have
access to which applications and how much of each application they can use.

I have a couple of ideas for implementing and checking for groups/roles and
finer-grained priviledges, but I would like to read some of the group
wisdom. Any anecdotes, opinions, don't-do-this's and war stories would be
appreciated.

Thanks, in advance!

Bill