Permission system design - Part1

I have been trying to implement a decent permission system in rails. there are many plugins out there. the most useful one " to my needs" was the authorization plug-in. I am trying to solve this issue in the context of ruby, and rails ; but ideally the design of a permission system is a general well known problem.
Let's take for example a system that has multiple modules, like for example, calendaring module and room reservation modules, there is multiple levels to the permissions that can be granted :

1. Per module permissions : where a permissions are granted to users to create_calendars, or view_calendars. for the other module these could be like delete_reservations .. and so on.
2. Per object permissions: where i wanna give permissions on a specific object or instance, like for example if we have a calendar called employees, and another called management, then i would like to give a permission edit_calendar on the employee calendar for the hr user, and an edit _calendar permission to the personal assistant of the manager on the manager's calendar.
3. Per field permissions: for example i want to give the permission edit_calendar_name to only the administrator user. Note that this can level could work hand in hand with the previous point.
4. Per object-user role permissions : Assume in a reservation you will have two roles, creator of the reservation, and guests. then I would give reservation_view_creator to a user A. this will then restrict the user to viewing only reservations to which he is the creator of . this as you can see is more of restriction rather than a permission. i.e : granting reservation_view_creator will limit the viewed items rather than increasing them.
5. Now take everything i mentioned, and add to it user group based permissions. like in most system each user will have a role (admin, moderator, guest). so the permission system should understand if a user is part of a group that has a permission, she should inherit the permission too. also in point 4, the permission reservation_view_creator_group should allow users to view all reservations where they OR a person in their group ( role ) is the creator. this is related but not the same as number 5.

This is the problem domain and the solution is to follow.

events calendars in rails appllication

I am currently working on a rails application, which is supposed to allows users to create events (holidays) and view shared events on a calendar. the requirements are simple. the required calendars are merely views. there is no interactivity needed other than providing links to the events.
so like any rails enthusiast, i went to Google and assumed i would find plenty of stuff to help me. it turns out my expectations were too high.
i found one worth while simple rails integrated calendar, its the calendar helper, which is bundled as a rails plugin. you can find it here : http://topfunky.net/svn/plugins/calendar_helper/
the plugin provides a function that can be embedded in a any view to create a calendar. its CSS is not that good. it however provide a starting point.
another option we had is embedding a Google calendar. the idea is that the rails application will have a Google account from which it can manipulate events on the calendar. Google calendar does provide a lot of integration libraries in many languages( php, .net ). sadly though, none for rails or ruby. there was one plugin for Google calendar that was available for rails (benjamin.francisoud.googlepages.com/googlecalendar). we gave it a shot .
problems we faced :
the plugin doesn't pick up the event id (provided by google ) after inserting. so you can really update events ( you have no reference id to them) . and even API doesn't support any of this functionality. i.e the plugin only lets you insert events ( no edit, deletes, or updates) . (this is what we found at the time of this post).
We are working on getting this calendar into a shape, and we will release the new code once we think its mature enough and usable by others.