I'm looking for a name or design pattern on an ACL Based permission system (at least, I think it has some features of ACL).

The case
An admin is allowed to create Managers. These managers will be granted several permissions based on what the admin submits when creating the manager (note that the permissions per manager can differ). If allowed by the admin, a manager is able to create their own employee's. Only the permissions of the employee's can never extend the permissions of the managers and the permissions of the managers can never exceed the permissions of the admin.

What is this kind of permission system called? Are there any standard definitions or examples of this? Or is this a novel approach to user security?


This is typically recognized as a roles access control approach, apparently NIST has written quite a bit on it and titled it "RBAC" - Roles Based Access Control. Moreover, they have given a standard name to the particular flavor of roles access control you described: They call it "Hierarchal RBAC".

Here's a NIST PDF which goes into great detail on it's conception of "RBAC" with much written regarding "Hierarchal RBAC". To quote a little (emphasis mine):

The Hierarchical RBAC component adds relations for supporting role hierarchies. A hierarchy is mathematically a partial order defining a seniority relation between roles, whereby senor roles acquire the permissions of their juniors and junior roles acquire users of their seniors. In addition, Hierarchical RBAC goes beyond simple user and permission role assignment by introducing the concept of a role’s set of authorized users and authorized permissions. A third model component, Static Separation of Duty Relations, adds exclusivity relations among roles with respect to user assignments. Because of the potential for inconsistencies with respect to static separation of duty relations and inheritance relations of a role hierarchy, the SSD relations model component defines relations in both the presence and absence of role hierarchies. The fourth model component, Dynamic Separation of Duty Relations, defines exclusivity relations with respect to roles that are activated as part of a user’s session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.