RBAC-based permission system-Welcome to explore !!

Two years ago, when I first started learning DOTNET, I had a permission system. At that time, it was only done as needed, and there was no reference to any standard model: including users, user groups, and roles. Now let's look at it. The original design basically conforms to the RBAC model, but unfortunately it focuses on fine-tuning the user's permissions. As a result, I picked up sesame seeds and lost watermelon.
Now, we can use Java to create a general security system. The permission section decides to use RBAC as the basic model. After a period of research, I have read a lot of related information on csdn and J-channel forums.ArticleAnd finally begin to design. There are still several questions that are confusing:

Does 1 group need to exist in the permission system? (Not in the RBAC Standard Model)
2. What are the advantages and disadvantages of Multi-inheritance and single-inheritance in the model that supports H-role? What do they apply?
3 is it necessary to implement dynamic separation of duties and static separation of duties at the same time? How should we implement it?

I hope you can give more advice on this aspect. We also warmly welcome the interested brothers and sisters to discuss it together !!!