Either I don't understand your comment, or you don't understand chmod. What you describe ins't beyond chmod; it's the basic functionality of chmod.

setfacl can do.
It's just that some *NIX users want the stupid POSIX model and authenticating with user-ids (+ private keys) instead of proper usernames and password (and private keys).
Go figure /shrug

chmod can do 95% of everything I've ever needed, just with the "user" and "other" category. Private files, public-readable files, public read-write files, programs I compile but anyone can run... all that is just in the "user" and "other" category of chmod.

It gets 99% if you add the sticky bit (used on /tmp) and the "group" category. Serial ports are owned by root:dialout, and mode 660. To get serial port access, just add the user to the dialout group. For group assignments in college, each partner pairing had their own group they could use. Group work files were mode 660 so groups could edit each others' work, but other groups couldn't peek.

For the last 1%, use setfacl. It does everything that explorer.exe's security tab can do.