I would give my left leg to learn how the permissions system worked – do end users (and PHBs) get to edit the rules directly? I fully expect some HR ass to go:

  can_view(Person) :- didPITAOnlineTraining(Person), ...