Schema for an RBAC (Role-based Access Control System)

Question

I want to implement an RBAC, Flat based. I've decided to base my system on the NIST standardization model.

Although all fine and well, I have an inclusion to that design.

Instead of a hierarchy for roles, I have a hierarchy at the permissions side: each permission will be related to a "module".

I'll explain with a diagram:

User U1 -> R1 & R2.
Role R1 -> P1, P2.
Permission P1, P2 -> Module M1.

1. A user can have multiple roles.
2. Multiple roles can be assigned to a single permission.
3. A permission can only be assigned to a single module.

What I have in my head in terms of a schema to hold this data, is as follows:

ac_users
     user_Id
     userRole_Ref

ac_user_roles
      role_Ref
      user_Ref

ac_roles
      role_Id
      role_Title

ac_modules
      mod_Id
      mod_Title
      modPerm_Ref

ac_permisions
      perm_Id
      perm_Title

ac_permision_roles
      pr_Id
      pr_Role
      prPerm_Ref

I'm worried this will cause to much overhead for this particular design.

The basic concept is that all tables will need to have a many-to-many relationship, except for ac_permissions which will have a many-to-one relationship with ac_modules.

Could anyone point out flaws with this design?