user roles or access levels

Question

I am beginning a new project and I already know that I'll have various roles for various users, regardless of their access level. They just have different jobs to do.

With that in mind, I'm thinking that I'll have certain actions that can only be performed by those who have a certain role (like being in a group)

The other method that I thought of would be to assign each user a level number and assign each action a level requirement (probably admin=0 and untrusted = SOMELARGENUMBER).

Is there a reason to prefer one method over the other? (security / maintainability...)

Answer 1

Levels make everything tiered. You can't have person A have access to one set of functionality and have person B have access to a different set of functionality but not the set A has access to.

Groups can be nested and you could even have levels within the group if you wanted to have a hybrid of the two. Fundamentally it really depends on your security needs and how you want to approach it though. Having security levels is far simpler from an implementation standpoint (you just store a number instead of a list of permissions to check against) if you can make it work for your needs, but it is also more limited.

Answer 2

Roles with very simple and obvious names and definitions, like "printers" and "network", so that when you know you're going to add a network printer you can assume both roles.

Assuming, of course, that your role mechanism allows you to mix and match!