Access control where a user can belong to multiple groups with multiple permissions?

Question

For example we have:

User1, User2, User3

Group1, Group2, Group3

Permission1, Permission2, Permission3

User1 belongs to Group1 where it can do Permission1, and Group2 where it can do Permission2 and Permission3, etc.

Is there a simple UI pattern for this? Is it still necessary (wasn't planning on it) to assign the permissions to roles then users to those roles even for this simple use case?

Answer 1

In a well designed system:

• Users should be assigned to Groups
• Groups should have assigned Permissions

This allows separation of concerns. It would not be smart to set up the system to allow arbitrary permissions when adding users.

From a UX perspective, this simplifies things too. You can use checkboxes or multi-select fields to assign a User to multiple Groups.

Here's an example of a school:

User Groups:

• Professors
• Parents
• Students
• Accountants

Permissions:

• View Enrollment (All)
• View School Fee Balances (Accountants, Parents)
• Enter Test Scores & Results (Professors)
• View Test Results (Professors, Parents, Students)

If you had a user Sam that was a Parent of one of the students and a Professor at the school - it would be easier to add Sam to the respective groups instead of trying to figure out which individual permissions to assign her.

RBAC

You're operating in the area of Role-Based Access Control (RBAC) Having worked on type of UI, I can attest that is not a trivial design problem. There's perhaps more thinking and design involved that might be reasonable to offer for free on short notice on a site like this. (Though I would genuinely love to be proved wrong on that.)

Consider:

Google image searching around the area 'rbac ui' 'rbac groups ui' will find some examples of this type of UI.

Research apps that offer RBAC. My go to in this situation would be Google Analytics, though I could probably drum up other with an email to my IT department. Be inspired by other versions of what you're trying to achieve.

You're basically looking at some tables that offer views of different groups, that communicates and enables their connectedness.