expanded user access management

I have been frustrated by the limitations of Drupal's user management. I would love to see Drupal adopt a more sophisticated access control system, with groups and permission inheritance (perhaps along the lines of PEAR::LiveUser). I see something like the following...

Areas

Each site is broken up into functional areas, typically associated with an individual module or group of related modules.

Roles

Each area has one or more roles associated with it. A role is granted a specific set of user rights. Roles can be implied, so someone in Role-A may automatically gain the rights of Role-B, even though those rights have not been explicitly defined for Role-A. In this case, having Role-A implies that you also have Role-B. By default, every area will include an area admin role that automatically gains all rights associated with every role in that area.

Rights

A right is a specific privilege that can be granted to a user. As with roles, rights can also be implied by other rights.

Groups

A group is a container for users. Individual Groups can be assigned any combination of roles and rights from any area. Sub-groups can also be defined. For instance, if Group-B is a sub-group of Group-A, then its members are automatically assigned all the rights and roles of Group-A, but they can be assigned additional rights and roles as well that are not shared by the containing group. Site Admin is a special group that automatically gains all rights and roles associated with all areas of the site. Other special groups might include Guest and New User.

Users

A user represents an individual person. Users can be put in any number of groups. Users can also be granted rights and roles directly.

This feature would allow for amazing flexibility and power in Drupal's user management, with fine grain control available to those who need it. Some other feature requests, like this one, would become trivial to implement.

The addition of groups and implied rights would allow for a much cleaner, more user friendly, administration interface when managing complex sites with lots of users. It would also allow site administrators to be more creative in the way they use various modules. Module developers would set the area, roles and rights associated with their modules, but the site admin gets to create groups with any combination of rights and roles (across multiple modules) that that they see fit. A site with dozens of modules could be managed simply by assigning users to one of a handful of groups. And the odd user who needs "special" privileges could get them without much trouble.