Fine-grained access control for API resources

Hi,
I need a little help. I'm trying to create access control lists that can be used to share resources with others in a similar way to Google Drive/Sites/... For instance, if I have a business object named "My Site", then I should be able to share this site with others, including permissions and (web) visibility rules. The question is, how to implement ACLs using ASP.NET Identity (Claims)? What is the suggested pattern? The following table contains two access control entries for the same resource:
ItemType | ItemId | Scope  | ScopeId | Permission | Visibility -------------------------------------------------------------- Site     |   1    | Anyone |    -    |  CanView   |   Public -------------------------------------------------------------- Site     |   1    | User   |    1    |  I ...