Quick answer which is all I have time for at the moment:
a.) I haven't tried specifying such a rule in Drools however that makes perfect sense. It's a matter of having access to the data Drools needs to resolve your rule.
b.) I don't know of any example of this.
c.) In my case, actors would be determined by looking at LDAP data, specifically roles and geographic location or membership in some local group. I think the actual logic on the application side would be simple so I don't know whether I'd see a need to develop a Drools rule.
--JE