I'm working on a permission-based access project. I have a long list, in the hundreds, of permissions that will allow Administrators of the system to customize permission groups for individual users. What UI delivers the best experience for navigating and selecting from a large number of permissions?

My Dilemma

It is obviously not a great experience to display a single list of 100+ permissions with checkboxes for whether or not that permission should be given to a user. I've been trying to break up permissions into "Administer", "Create", "Edit", and "View" type permissions which helps but still overwhelms a single page UI.

Has anybody had any success with something like this in the past and, if so, what design pattern worked for you?

  • Are these permissions overlapping? To clarify, if I can create - can i also edit? I assume i can. And if I can Administer, I would expect to have all rights.
    – Mike M
    Commented Jul 17, 2017 at 20:49
  • That's right, I'm working on that overlap as we speak. This could potentially cut the list down to about 50 or so.
    – John
    Commented Jul 17, 2017 at 20:54
  • I agree with Mike, when you're talking about basic CMS permissions in your example, how is it possible to have 100+ permissions? Commented Jul 18, 2017 at 7:18

2 Answers 2


Your best friends are going to be (un)check all buttons by both permission type and object type -- that is, giving a use the (in)ability to read every object type, or all/no permissions for a particular object type, with single clicks. Even if not always applicable, this can still cut clicks by an order of magnitude.

This works best in a table format, with object types on one axis and permission types on another. This is also the most compact you're going to get. It may help to break things into multiple tables -- for instance, with financial objects in one list and technical ones in another.

Apart from that, the best way to tackle sufficiently complex permissions for large numbers of users is to abstract these into roles, which are collections of permissions which may be assigned. The user's ultimate permissions are the union of their role-based permissions. Thus for each user, only a handful of options are displayed. The pain of going through hundreds of boxes is mitigated by only having to do it a few times.


Users might find it helpful to be able to filter the permissions for a given search string or to put often used items into a favourites list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.