It's the "implement" part I'm being lazy about. :} I'm probably just dreaming, though, thinking there's something already implemented, since it's probably fairly application-dependent. Also those presumably require using CGI::Application, which I don't necessarily want to do.
I read more about RBAC last night, and it does seem (in an abstract, theoretical way) a lot like what I have in mind. There are apparently a few implementations of it -- especially in Java, which I guess is (fairly or not) more associated with "enterprise" applications.