Does it make more sense to only set permissions on roles, and the give roles to users, or should the application allow specifying user roles AND permissions?
I'm not sure if allowing both to be set on users is overkill.
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.Sign up to join this community
Definitely better to set groups (aka roles) and assign both users & permissions to the groups. A group can have multiple permissions (often MANY) and a user can belong to multiple groups (and have the cumulative set of permissions).
As far as the unique user who needs "everything", many systems will allow a Superuser to have access to everything. If that is not what you need (e.g., "everything except user account maintenance") then make a group for that user and add all the necessary permissions to it - only one small step extra the first time and updates are no worse than if you added the permissions directly to the user. And if you add a second power user then you have now saved yourself a lot of trouble.
It depends on the nature of your target organizations and their users. I can tell you that IT departments have frequently had to make special exceptions for me because I didn't fit their pre-defined roles and needed to also do "this thing over here."
The problem with allowing user-specific roles is that managing it in the future, or handling an audit, can be difficult. If Eric the company's only data scientist leaves the company, how easy will it be for Ji his replacement to get everything set up?
Consider making roles hierarchical. If a user needs special permissions, enable rapid generation of a new sub-role: business user, sub-role marketing, sub-role PR-qualified.