Permissions and roles

Question

Do you think is better a permission-giving approach where by default you assign to new users the less powerful level existent or a permission-taking approach where by default you assign the highest level and then is up to the user to take away permissions?

In my specific case there is not access to very sensitive informations like billings and personal details of other people.

---

Thanks everybody, is exactly what I was thinking, but now I will have different flavours of the same argument to support it in the next meeting :)

Answer 1

One major advantage of adding permissions rather than removing them is that if you add new features, they are, by default, not permitted to anyone, and you have to make a conscious decision as to who needs this functionality. This can be used to give permissions to a few test users to start with, and then expand it.

It is also very important to give users what they need - and not more. If you give people a whole lot of stuff that they don't care about, it is junk, and will distract the user from doing their job. And people will not remove themselves from these - they will just ignore them, or try them out and do something odd.

The idea of permissions is not just to make sure that Minions cannot do Important things, but also so that those who need to just Get On And Do Their Job can do that. It is a positive thing to only give permissions as needed.

Answer 2

From an application security standpoint, you may want to implement the Principle of Least Privilege where possible. In addition to security benefits, it may also help reduce cognitive load and help users perform their tasks easier without having to figure out which features they do/don't need.

Answer 3

You should give the user permissions such that they use only the functionality necessary to complete whatever goal they came to the site for. Extra controls may at once be superfluous and irrelevant to requirements or may have a monetary value associated with them that only advanced privileges and subscriptions would take into account.

And

Giving the users features they don't need and letting them remove them manually sounds bad because the extra features will increase cognitive burden and may give potential money making resources away for nothing.

Answer 4

I started to think of this as a security issue, but realized it's also a security management issue. Administrators are sure to encounter both ends of the scale, where it's easier to remove a few permissions (starting with all) or adding a few (starting with none or minimal). Letting them move between the two extremes when managing permissions seems best.

That does beg the question of what should be the default. You mentioned in your question that In my specific case there is not access to very sensitive informations like billings and personal details of other people.

If the stakes are truly low in the mind of your audience, then starting with more permissiveness is probably alright. But if it's possible for mistakes from being too permissive by default will harm the way they feel about the site, it's better to start less permissive and absorb the cost of opening things up when you have to.