Schema to model user authorization in hierarchical data

I'm trying to add the ability for a user to be authorized with a given role on a contract/site/experiment. More specifically, I want the ability for a user to have role A on a contract but at the same time role B on a specific site of this same contract and possibly a role C on an experiment of this site. My first idea was a join table between User and Role with a third column storing the id of either a contract, site or experiment. This solution has many problems in my opinion: - I need a row for the contract, each authorized sites and each authorized experiments. It can grow very large very quickly. - No integrity. A non existant contract can be referenced - If I want to know all the sites and experiments of a contract where a user is authorized I have to first query all sites of this contract, then all the experiments of these sites and then find all the rows referencing those ids. It seems a bit hacky. I feel like this solution could work but I was wondering if there were other way? Maybe some pattern I am not aware of? PS: I am using MySQL v8