Hi,
I'm curious if there are any best practices regarding how to structure roles and ACLs (and to an extend, the groups they're attached to).
Do you use one role for a persona, which contains multiple ACLs (for example, an admin persona has exactly one role, "customtable_admin", which contain full CRUD ACLs), or do you use multiple roles that basically correspond to ACLs ("customtable_create", "customtable_update", ...) and attach all of those roles to the "customtable_admin" group?
Here's a drawing to illustrate my point:
 
I can see advantages and disadvantages for both approaches:
- The "Persona implemented via roles"-approach results in less roles and ensures that any person or group receiving the "custom_table.admin" role will actually receive all required permissions. On the flipside, it probably requires more preparation and planning, and changes require a deployment.
- The "Persona implemented via groups"-approach results in more roles, and provides more flexibility. On the other hand, it seems a bit unorganized to me, and if you wanted to create a new group, you'd need to make sure that every role that's required is attached to it.
What are your thoughts on this?
