I am newbie at these stuff and while I was able to distinguish between role-based vs. policy-based authorization models, I can't seem to understand whether there is one between policy-based vs. permission-based. On a conceptual level, what is the difference between them? Can policy and permission terms be used interchangeably?

1 Answer 1


The classic example of policy based auth, which I'm sure you have seen if you have googled, is a alcohol selling app, which in (normal countries) would read:

Allow user if user.age > 18

this is apposed to role based which would read...

Allow user if user.role is in {"Adult"}

or permissions based which would read

Allow user if user.permission == "CanBuyAlcohol"

The benefit of the role based is obvious when you consider that the rules which put someone in a role can be arbitrary. For example some countries alcohol is illegal and some have different ages, you can see how your authentication code can become complex

    If user.country == UK
       Allow user if user.age > 18
    else if user.country = "US"
       //check local state laws
       Allow user if user.age > 21
    else if user.country.religion == Muslim && ! user.IsTourist
       return false

Obviously with role based auth you still have to do this somewhere to see if you can put someone in the various roles. But this can be delegated to a human or a separate specific bit of software rather than being embedded in your application, which might not care about these details.

Permission based is considered problematic because you end up with a massive grid of users and permissions that's impossible to maintain.

userid, canBuyAlcohol, canBuyCigarettes, canPlayInBallPit
1, yes, yes, no
2, no, no, yes
3, no, yes, yes ?!?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.