Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

4
  • Have you looked at developing Access Control Lists using groups/roles (similar to unix file security)? You will need roles, resource & action. In your case resource will be object id, action will be read and role will be GM. Commented Oct 4, 2015 at 22:02
  • @jhash groups and roles are not synonyms. Unix file security without extensions is a DAC model. Commented Oct 4, 2015 at 22:06
  • You are correct. BTW does the approach work for you or do you have any specific concern about the approach. WRT the documented approach, just wanted to point out that what you are seeing is called "role explosion". Commented Oct 4, 2015 at 22:15
  • @jhash I thought "role explosion" was when I had to create more roles than what seems reasonable (like role type per org in multitenancy). So far I'm not seeing that. I'm just looking to see if there are better solutions than what I've come up with, and advantages/disadvantages to the approaches. Commented Oct 5, 2015 at 4:16