The "systematic" part of things is relatively easy to handle (as the code can be made to handle anything complex) - it's the "user" interface that is harder. A user with root access wants to give access to a given file/directory to a user - this needs to be made easy to do successfully and securely. Too many times I've seen entire web directories 777 because they just wanted it to work.

Commands providing "why user X can't access Y" and recommended solutions can help.