A user authorization system may include a database server maintaining, in a database, a cached user rights list specifying associations between users and related entities from which the users inherit rights and an access control list specifying permissions of entities to access objects. A server may receive a request from a user to access an object and pass access information to the database server. The database server may filter the access control list based on the cached user rights list to generate a filtered access control list specifying permissions to the object for the user and return the filtered access control list to the server. The server may then utilize the filtered access control list returned from the database server to determine whether the user has permission to access the object.