Systems, methods, and computer program products are provided for performing an authorization check for a user. In one implementation, a data processing system is provided that includes means for storing first data descriptive of at least one directed acyclic graph and for storing second data descriptive of an assignment of a user to a first node of the graph. The data processing system also includes means for receiving an access request of the user, the access request specifying a second node of the graph. Furthermore, the data processing system includes means for determining a least common ancestor of the first and second nodes of the graph and means for performing an authorization check adapted to grant authorization for the access request if the least common ancestor of the first and second nodes is the first node.