Let's say a tab menu like the example below was used.
Each tab has access control. Some users can see all the tabs, some users can only see some of the tabs, but all user will have permission to at least 1 of the tabs.
To complicate matters, each tab is part of a single big process. For example, if the page has multiples tabs, the first tab will be used for the first part of a process, the second tab will be for the second part and the last tab will be for the last stage of a process.
The access control will be used to control who is involved in each tab.
What is a good user experience for this kind of system when preventing the user from accessing those pages/tabs? For example, should those tabs that user cannot access be removed? The problem of removing tab is that it breaks up the continuity of the tabs.
A simple prototype was created to illustrate the problem.
- User1 can access all tabs. This simulates a power user.
- User2 can only access tabs 1 and 2. This simulates user who is required to complete the starting part of a certain business process.
- User3 can only access tabs 2 and 3. This simulates user who is required to complete the middle part of a certain business process.
- User4 can only access tabs 3 and 4. This simulates user who is required to complete the last part of a certain business process.
Query string "user" in the URL is used to set the current user.
As shown in this example, the access denied page is working correctly, allowing only the correct users to access. However, the user experience is not good. The user might be confused about why this is happening and think that some system error has occurred.
Possible improvement by bringing the access deny message into each of the pages;