Which one is better option for an admin from a usability point of view? Suppose if a system is supposed to authorize a user to have access (and different type of access like read only or read write) to only a few entities, then should the system put onus on the admin to give access to the user/role for those entities. Or, should the admin just specify what user is not supposed to have access to, assuming that by default he has access to everything.
In the first case, the admin is supposed to do a lot of work. Everytime a new user/role or a new entity is introduced in the system, admin has to sit down and make sure that this entity is made available to its users. It could be a lot of work for the admin if the application has a lot of roles and entities such as an ERP system.
In the second case, all users have full access to all the entities unless admin make decides to step in and put restrictions. It could lead to security loop-holes if restrictions are not placed on time.
Please let me know if there is already research done on this.