...
CloudStack currently has a domain-tree based implementation of access checks, namely com.cloud.acl.DomainChecker. This implementation is based on the an adapter interface of Cloudstack - org.apache.cloudstack.acl.SecurityChecker that defines the basic ACL interface to check ownership and access control to objects within the account/ domain.
The IAM plugin will provide another implementation of the SecurityChecker intrerface. We will also have to add to this interface some more methods or change some signatures to facilitate policy and Action based access control.