When well engineered the resulting access matrix becomes a matrix of roles and containers where subjects are grouped by roles and objects are grouped by containers.
What is a role and what is role engineering?
What is a container and what is container engineering?