I am following the rbac model in my system. I want to know if I should prepopulate the resources and permissions table?
I have resources like contracts, contract_drafts, SLA (service level agreement), etc. And permissions like create contract, modify contract, approve contract, etc.
Now, I want to know if the system should already have the main resources and permissions loaded into it when I give it to the users?
Because what if I need to know the permissions a certain role has over a contract resource but that contract resource hasn't even been created by the admin yet?
How can I even make sure that there will be contract resource in the system?
Or should the only things that can be in the admin's control are roles and users? Which means that permissions and resources will be predefined. He just has to assign them to the correct roles and users.
Another thing that can happen by allowing the resources to be created by the admin is that he might even create a resource called electronics for example which has nothing to do with my system.
Please feel free to ask for any clarification.