This question about RBAC implementation. Can a subject have a role in a certain realm?
Suppose a university is made up of departments. Departments have courses. Courses have students. Students have grades in courses.
Note that these grades are WITHIN the realm of a particular department, but they are not directly OWNED by the department.
We wish to declare that the "department head" role should have access to all things within the realm of their department - including all grades. Is there a standard / recommend way to do this. I am (slightly) familiar with ownership, but the grades are owned by the student. The fact that the grade is within the department is indirect.
From my initial reading, it seems that at least, one would have to create many duplicated roles - "math department head", "history dept head", "english dept head", etc. It seems preferable to define the "department head" role and assign that role to a subject _relative_to_ a certain department, then have that flow down to grades within department X. Is that possible? Thanks so much for your assistance.