Drupal 6 access control question for basic user groups (not using OG module)

We encourage users to post events happening in the community to the community events group on https://www.drupal.org.
vood002's picture

I'm hoping for some strategy input if anyone can be of assistance:

I have a client who is running Drupal 6 and requesting functionality that looks like a good candidate for OG, but honestly OG seems like overkill for the request...I was hoping to get some input on the best way to handle it.

Essentially they want to be able to create downloads, groups and users. They'll create downloads that are available to groups of users. Create a download, tag the groups that can download it. Create a user, tag the groups that user belongs to, done: the user is able to download that file.

The reason I shy away from using OG as the solution is that this is all they want to use this system for...they don't want any of the 'organic' component of OG, no discussions, nothing...simply a group of users who has permission to download a certain file.

After looking around it appears that if I'm not going to use OG my best bet is to develop a solution using ACL.

This seems well and good to me, although looking through code of a couple of modules that use the ACL API it looks a little more complicated than I figured it would...judging by the description of ACL I figured I could control everything from hook_nodeapi(), writing records on insert, update & delete and reading permissions on load. Perhaps it isn't that simple.

Anyone have any recommendations? Thanks in advance!