I have to write a node module for handling role-based access control. Users are stored in database, there are user groups, and there are system assets or functionality that users and groups can be given or denied access to.

I am considering the most appropriate terminology for these concepts:

  • system asset/functionality = "right"?
  • that a user is allowed to access certain asset/functionality = "permission"?
  • We cannot help you with this because there is no objective criteria here; its up to you. I have seen all three terms used in access control code. I use permission because right is something that you are entitled to instead of being granted and privilege is luxury; Think of it from the point-of-view of a moderator or adminstrator: they have to take adminstrative action. They are granted the permissions so that they can do their job - thats the only reason. And to me that is neither a right nor a privilege. – marstato Sep 30 '17 at 10:47
  • 2
    Are you aware that RBAC has defined terms? en.wikipedia.org/wiki/Role-based_access_control – schroeder Sep 30 '17 at 11:15
  • 2
    You should not implement authorization yourself. There are many modules that implement rbac and ABAC out of the box. It'll save you time and you won't make implementation mistakes. Look into what NIST has to say on RBAC and ABAC. – David Brossard Sep 30 '17 at 23:54

Role Based Access Control is a well defined model, that comes with its own terminology. At minimum, RBAC has the following entities:

A User has one or more Roles.
A Role is a collection of Permissions.

A Permission (or privilege) is the right to perform an Operation (or action) on a Resource (or object).

So, from what you describe in your question, I would say that

  1. your model is not complete yet (operation is missing);
  2. your 'system asset/functionality' is a resource;
  3. "that a user is allowed to access certain asset/functionality" is indeed a Permission
| improve this answer | |

Rights: Rights are basically type of tasks which users can perform for particular purposes.You assign rights to groups or users.

Example: The role of content managers is to access content but not with databases, so users that are content managers should have content management rights but not database management rights.

Permission: Permissions are settings which determine what a user can do on items or resources for which they have rights in an organization.


Read: users can view data.

Write: users can edit or create data.

Delete: users can delete data

Privileges: The privileges are assigned to one or more groups to permit a user of those groups to manage system modules.

Example: To create a module for reporting in a website, a user needs its development rights and write permissions so that he can develop the module.

| improve this answer | |
  • 1
    Do you have references or anything to back up your use of these terms this way? Your descriptions are not normal and do not conform to established definitions. – schroeder Nov 3 '19 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.