It depends on what you needs are. All I needed was some GUI to manage the RBAC tree in the DB. RBAM was all I needed and it provides me with both RBAC tree management AND auth items assignment to users (associating roles with users). I just had to relax its weird bizrule validation rule and aside from that I’m very happy with this extension and recommend it.
Rights was an overkill for me. It was too complex IMHO (with the restrictions I had when researching and implementing) and I didn’t need its CWebUser class etc.
RBAM extension isn’t only for light systems. I have 122 “Auth Items” (in AuthItem table) and at least to my impression (not in comparison to other), it represents a rather detailed permissions/authorizations tree. All I needed/wanted was a good GUI to manage the auth items and RBAM seems to provide it.