0

I'm working on improving the current layout for managing group and user permissions - mainly the presentation of these things. The way it currently works is that all permissions from a group (Read/Write or both) are propagated to all users within that group (illustration below):

enter image description here

We are using tabular layout (and we want to stay with it) - when we click on a group, we can see what users are in that group and we can revoke/give permissions to that group and users.

Here comes the first change - we don't want to revoke permissions for users belonging to the group - all permissions should propagate from the group they belong to (so the only option to revoke a user's permissions would be to remove him from the group). Since we are giving up the exclude mechanism, I thought that the R and W buttons next to the users should no longer be clickable - they should be grayed out, so that the user can only check which users are in the group, but they cannot revoke the user's permissions:

enter image description here

But here comes another problem that I do not know how to solve - so I want to get some advice. Our environment works in such a way, that a user can be in several groups at once (this is normal). But apart from that users and groups can have certain roles - I don't know if it's not a bit of a departure from the standard RBAC (Role-based access control) model - because here both group and user can have some roles. The same with permissions - a user can have permissions granted from another group, or from himself.

In this case we may have a case where a user has his own permissions, but at the same time belongs to a group - I think it should be marked somehow that this user doesn't propagate only permissions from the group, but also has his own permissions - maybe with some color on the R/W icons? To distinguish him from users who do not have their own permissions at user level, but inherit them from the group. I'm talking about presenting in some way the scope of these permissions.

Additionally, it may happen that a user belongs to e.g. 2 groups (or more) - in one group he has all the permissions, and in the other he has none (because the group has neither R nor W permissions) - should it be noted that the user has permissions, but not specifically from this group (but from another)?

Side question: What if a user belongs to several groups where permissions (or even roles) are mutually exclusive? I was thinking about making the sum of permissions/roles in this case - IMO the best solution (although maybe someone has some other).

Thank you in advance for all the help (and for reading this whole post), sorry for those illustrative drawings - as I mentioned, they are only illustrative :)

3
  • Super-common problem in SAAS software - users are granted a base role, and then more granular roles/permissions at group levels. Perhaps you could study Slack, Teams, JIRA and other products where there are group and "universe" permissions for pattern ideas.
    – Izquierdo
    Nov 5, 2021 at 14:48
  • Hey! Thanks for your comment. Honestly, my first thought was to look at Facebook groups and permissions, but that wasn't very helpful. Do you recommend reading the documentation for these products, or testing how it works on its own?
    – JimPanse
    Nov 5, 2021 at 15:01
  • Perhaps you can get a free admin license (on Slack) and try adding friends to groups, or ask your company's JIRA admin if you could take a peek at permissions setup (if you use JIRA, etc.). I think playing around with several products could give you a feel for how complex use cases are handled.
    – Izquierdo
    Nov 5, 2021 at 15:16

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.