Well, you could store everything in a database, but you will need to store all your rules in there as well, then populate your ACL class each page load.

For my site, I have 5 or so user types, and decided to simply keep them loaded in the class itself. I may go back sometime and put them all in the database, but if you do that you need to build an admin page to modify your permissions.