I've come onto a new a project and the permissions are done with an allow and a deny option for every permission. Until now i've only ever seen/build allow only permissions.
What is the advantage of this? It seems to introduce extra complexity for developer as well as enduser.
The only situation i could think of that an Allow/Deny design can handle, that a Allow-Only can not is the following.
Role has a permission: AllowX = true and DenyX = false. User has an empty permission.
In an allow-Only design you cannot add an empty permission to the user as only AllowX exists, so the "empty" user scoped permission (where it says AllowX = false) would override the role scoped permission.
But there are obviously many ways to handle this. Just dont add an empty user permission by default. Make the default user permission an aggregate of the role permissions.
However you see this Allow/Deny model in windows and probably a lot bigger apps. Whats the reason?