Study design patterns. Topic question

Hello, Habrasoobschestvo. I am writing in a personal blog, since this topic is a question. So, quite recently I attended to using sane design patterns in my poky applications and I encountered the first question that I couldn’t google.
The essence is this: let's say we have domain objects “company”, “user”, “virtual file”, “virtual folder”. Here, everything is more or less clear - we create factories, data mapper and storages. But the creator of the file can assign file permissions to employees, and then you have to do a permissions check. The first thought is to transfer the “User” object to the storage search method, so that this method checks the access rights, but for me it looks like barbarism. What if another part of the application wants to get a file? To make an argument of type "User" optional?
Revised Fowler, stumbled upon the Service Layer. It proxies client access to domain objects. But failed to googling anything intelligible.
Is akl part of business logic? Should akl and the like be distinguished from domain objects and their storages?