Let's say I have users, groups (or "roles") and resources, and I want to manage various permissions on those resources. As far as I can see, there are two main "philosophies" when it comes to permissions.
* All Resources: DENY Group G1 * All Resources: ALLOW Group G2 * Resource R1: ALLOW Group G1 * Resource R1: ALLOW User U
You have a (configurable) unordered set of permissions, and a (built-in) ordered list of precendence rules (e.g. "user permissions override group permissions", "DENY permissions override ALLOW permissions", etc.) which determine which rule applies.
The other system, which I will call "order-based", is used, for example, by iptables:
1. Resource R1: ALLOW User U 2. All Resources: DENY Group G1 3. Resource R1: ALLOW Group G1 4. All Resources: ALLOW Group G2 (5. DENY)
We have a (configurable) ordered list of rules (with an implicit final DENY or ALLOW rule). They are processed sequentially and the first matching rule applies.
I am tempted to choose the second system, because it seems (a) much simpler to understand (no complex precedence rules) and (b) more powerful (just a gut feeling).
However, the first system is widely used as well, so it surely must have some advantages. What are they?