How you implement is most likely a function of what you're implementing. We use something called PowerBroker. I can get you that information if that's the system use use to manage permissions (otoh, it generates a log so you can grok the parameters for any app you want to control).