What is the most optimal and traditional way to store access rights to a particular object?

Question

Database design

Conventionally, we have the following tables:

• Tasks
  
• Task statuses
  
• List of task statuses
  

and these:

• Users
  
• User rights
  
• List of user rights
  

We want to restrict users to access certain tasks by their status. Someone can view only new tasks, someone - only tasks in progress, someone - all together.
Question: What is the most traditional and correct way to organize this? Store data about it in some field of the task status list? Or use a table with user rights for this, creating a new type of rights for each type of task status? Or some third option?

Answer 1

RBAC + bizrule