If anyone has a good book on setting up a good authorization model in a corporate environment, please pass it along.

You just need a white list and a black list. Then conduct a background check to determine who is black and who's white. /s