re: just using the standard permissions - I tend to create an additional "readwrite" permission that has both "read" and "write" as children and is presented to the users (where appropriate) as if it were the "write" permission. Although things like file storage need a write permission that doesn't imply read (so drop boxes etc. work) there are many cases where "write" should imply "read" and having a single permission to grant and revoke in that case simplifies the UI and stops the users from getting confused.
