User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are building a web-based application which contains a bunch of images and documents, and there is a requirement to be able to restrict what images/documents a particular user can see. (It's your basic user access control stuff.)

One idea for implementing this is to make use of the tagging sytem that already exists in the application, so when creating or editing a user you will see something like this:


download bmml source – Wireframes created with Balsamiq Mockups

I think this could be quite a flexible system but I am concerned that I haven't seens user permissions implemented in this way before. Does anyone know of any examples where a similar concept is used?

I found a study ( that tested a similar concept and had promising results but I have yet to find a real-world implementation.

share|improve this question
Not implemented yet, but we are on the verge of doing something similar for the right to execute specific queries. It is considered more intuitive to set permissions like this. However, that may only hold true as long as only "allow" permissions are used. When you add "deny" into the mix (where deny is stronger than allow and allow is stronger than unspecified), things can get very complicated very quickly. – Marjan Venema May 17 '12 at 12:00
This has been implemented and works great. Check out the "super-tags" in Yes, it's a CRM, but the super-tags are quite great. You can also add additional fields to an object based on tags, e.g. you give the super-tag "journalist" to a contact item and whoosh you get some additional fields to fill out that are only relevant for journalistic contacts… – Oliver Jan 1 '13 at 20:37
up vote 1 down vote accepted

One of this issues with this approach is that you're adding in another administration area to the system: tag management. You will have to ensure that when content is uploaded it is assigned all the relevant tags, and that when new tags are identified you'll have to go through each individual photo and re-tag them one-at-a-time with the new tags.

While this is a perfectly usable approach from a user permissions management point-of-view it could escalate into a significant administration overhead from a tagging perspective.

Perhaps a better solution is to assign users into groups and then associate those groups with each image instead (or better still group the pictures together into groups / folders and assign user-groups to those users). Yes, it's a more traditional way of managing user-permissions but it could also be said that it's a tried-and-tested approach too. That way it's a lot simpler to manage when you identify new categories or want to change the user permissions.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.