I am building a website and in it I am trying to follow the rbac (role-based access control) model. Now, the thing is that managers need to send their contract proposals to approvers (people who will see if the company can go with the contract or not).

But, because I have the rbac model where the admin can create many roles, how can I make sure that there will be users who will be approvers of contracts?

I was thinking of having an attribute called is_approver which could be checked when the admin will be registering a new user if he is an approver.

Another possibility was to make the manager choose the users who should receive his contract proposal for approval. But then he would be able to send the contract proposal to users who aren't even responsible for this.

How can I make sure there will be approvers in the system despite the rbac model and that the contract proposal will be submitted to the right users?

  • Is your question "How do I make sure that at least one person has contract approval permissions?" You can find that out by running a query on your RBAC database tables. See below for a representative database schema. – Robert Harvey May 9 '17 at 22:19

Your (simplified) database schema should look something like this:

enter image description here

So your Permission table will have an entry in it with a PermissionType of "Contract Approver". You would then add records to the Role_Permission table to associate the "Contract Approver" record in the Permission table to each Role that should have Contract Approver permissions.

  • 2
    I'm guessing you got that here. Are you sure the one-to-many relation between Role_Permission and Permission is pointed in the right direction? – candied_orange May 9 '17 at 23:40
  • @CandiedOrange: It's not. Figures. – Robert Harvey May 10 '17 at 0:04
  • Oh yes. Now I understand where I was going wrong. I thought approver was a role and not a permission. But by making approve contract a permission, it totally makes sense. But now, would you recommend that when the users receive this system, it should be loaded with a few permissions in it already? Like contract approver. Because it's absolutely crucial. – imran.razak May 10 '17 at 9:36
  • 1
    Yes, you will pre-load the Permissions table with the set of permission types that you expect to use. – Robert Harvey May 10 '17 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.