Which approach makes most sense to use, the destructive one or the non-destructive one? Does anyone have real-world experience with one, both or even a different approach?
Model
A permission scheme has a set of permissions linked to it. It can also have a parent from which it inherits permissions.
Destructive
Taking away permissions from a parent scheme also takes away those permissions in any child scheme.
Reason to use this: when later re-enabling those permissions for a parent scheme, they are not automatically re-enabled for child schemes.
Reason to not use this: accidently taking away permissions from a parent scheme means the permissions for child schemes have to be restored separatly.
Non-destructive
Taking away permissions from a parent scheme has no effect on child schemes. The parent and child schemes are combined to determine the correct permissions.
Reason to use this: accidently taking away permissions from a parent scheme does not require the child schemes to be restored separatly.
Reason to not use this: when later re-enabling those permissions for a parent scheme, they are automatically re-enabled for child schemes.