Lets say a web application has four user roles. Standard, Supervisor, Manager and Administrator.

Should a manager be able to promote someone else to a Manager, or only to a supervisor?

I realize in the latter situation, an admin technically wouldn't be able to make any other admins, but administrators could always be an exception to the rule.

  • 3
    To be honest with you, Luke, you're probably the only one who can answer this question. You know your system and your needs more than us. Yeah, the standard is, if you have the GRANT privilege, to be able to give roles as high as your own. However, your case might be different. Do you want to have a single SuperAdmin account to resolve any issues? Do you want that particular user not to be able to grant his role to others, but be able to grant lower roles? It all depends on your case.
    – Adi
    Feb 14 '14 at 13:31
  • 1
    I completely agree, I guess I was just curious what the "standard" approach was, and if there was a particular reason for it.
    – Luke Sapan
    Feb 14 '14 at 13:48

Although it is up to you, common way is a user can set other users equal to them. There can be many admins if it is wished to be so..

Giving a lower rule is a harder case in my opinion.. I made you admin and you can un-admin me? weird huh? well...this could happen...

So yeah, I can set you equal to me, than you can downgrade me. Thus, having only one master user is safer. Not that there can't be many, but having a lot of them may lead in to using your app/website etc...

  • Excellent point about demoting. Maybe a system where equal level users cannot demote each other (unless they are admins) would be ideal. Then again, what happens if you accidentally promote the wrong person, whoops.
    – Luke Sapan
    Feb 14 '14 at 13:50
  • Than how about, you can not demote your equals? If this is a small app we are talking about, I would say only allow master-admin to arrange rules (which will be held by only one person)... if not, I guess for demoting you should have a higher rank and in case of a mistake, you should talk to your boss asap... There are ups and downs for each case... give me more info about the app, and i can help better.
    – cengizUzun
    Feb 14 '14 at 14:06

It really depends on how you want to set things up. If it is representing an organizational structure, it is fairly typical for people to be unable to promote someone to their own level since this generally doesn't make business sense.

If modeling like assets on the other hand, it generally makes sense for someone to be able to let others use anything they have access to.

It is also possible to make a hybrid of the two approaches in more advanced security models because you can grant people the ability to grant users access to something separate from their ability to access it, but this is more user based security than roles (however you could restrict someone from granting access to a resource to a role despite their access to that resource.)

There isn't a right or wrong answer. Choose whatever best fits your security needs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.