I'm currently in the process of setting up roles where there are regular users, admins, and super admins, each of which have special permissions. I deferred to this post on how to do so.
It basically comes down to either setting up a few tables in addition to the
Roles (second table),
UserRoles (join table) or creating boolean attributes for the
super_admin. While I'm capable of doing both what should I keep in mind in keeping my app secure? Is one better than the other? Explain.
I ask this because as the the second answer of the SO post states:
It really depends on what you wish to do with your admin role. The first option, I would say is a bit secure as the admin role is a unique model in itself.
The second option is straightforward and would help you get going with the least effort. However, if your users figure out the boolean variable and a way to set it, any user can become an admin and access areas you don't want them to.
Before coming to this conclusion I wanted to get a second opinion on the matter.