My application has users and administrators. The administrators split into two: super-admin and limited-admin. The super gets all permissions while the limited can be configured to inherit just the admin permissions that are specifically needed.
I am thinking to define my permissions the following way. Any user permission has an administrator permission:
User:
- post_create
- post_update
- post_delete
Administrator:
- administrator_post_create
- administrator_post_update
- administrator_post_delete
Is this a good approach? Should I rather assign to an Admin all the users permissions and then another one like 'administrator_post_manage_all' which bypasses the ownership check and allows an admin to make modification?
Edit
The following rules must be satisfied:
Only some users can create, update, delete posts; however, they must be the owners of the post to update, delete. Every user of the application should be able to read posts. My administrators should be able to update and delete any user's post.