I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to authorize action methods based on these roles.

Now I want to add support for privileges so that action methods can be restricted based on those as well, rather than just by roles. For example, in a Controller, I may have an HTTPPost action that only someone with a "Write" privilege should be able to perform successfully.

What changes do I need to make so that I can assign privileges to roles? I.E., I want to select the "Admin" role to have the "Write" and "Read" privileges, while a "BasicUser" role will only have a "Read" privilege. This way, an Admin can access any method that is allowed by the Write privilege, while the BasicUser can not.


1 Answer 1


This could be as simple as hanging a few more fields onto the Role table, like CanRead and CanWrite. If you want it to be more sophisticated than that, add a RolePermission table with a Role foreign key.

See Also
Don’t Do Role-Based Authorization Checks; Do Activity-Based Checks.

  • Using this approach, how can I restrict an action based on the privilege? Also I wanted to clarify that the CanRead and CanWrite are just two examples out of many possible privileges there can exist in the system.
    – ITWorker
    Jul 26, 2016 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.