Does it make more sense to only set permissions on roles, and the give roles to users, or should the application allow specifying user roles AND permissions?

I'm not sure if allowing both to be set on users is overkill.

2 Answers 2


Definitely better to set groups (aka roles) and assign both users & permissions to the groups. A group can have multiple permissions (often MANY) and a user can belong to multiple groups (and have the cumulative set of permissions).

  • If new features are added, the related permissions can be assigned to the relevant group(s) without touching individual user accounts
  • If an existing feature has the permission redefined for some reason (there are plenty of ways this can happen) then the relevant group(s) need to be updated but not the individual user accounts

As far as the unique user who needs "everything", many systems will allow a Superuser to have access to everything. If that is not what you need (e.g., "everything except user account maintenance") then make a group for that user and add all the necessary permissions to it - only one small step extra the first time and updates are no worse than if you added the permissions directly to the user. And if you add a second power user then you have now saved yourself a lot of trouble.


It depends on the nature of your target organizations and their users. I can tell you that IT departments have frequently had to make special exceptions for me because I didn't fit their pre-defined roles and needed to also do "this thing over here."

The problem with allowing user-specific roles is that managing it in the future, or handling an audit, can be difficult. If Eric the company's only data scientist leaves the company, how easy will it be for Ji his replacement to get everything set up?

Consider making roles hierarchical. If a user needs special permissions, enable rapid generation of a new sub-role: business user, sub-role marketing, sub-role PR-qualified.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.