Using tags for access control

Question

We are building a web-based application which contains a bunch of images and documents, and there is a requirement to be able to restrict what images/documents a particular user can see. (It's your basic user access control stuff.)

One idea for implementing this is to make use of the tagging sytem that already exists in the application, so when creating or editing a user you will see something like this:

^{download bmml source – Wireframes created with Balsamiq Mockups}

I think this could be quite a flexible system but I am concerned that I haven't seens user permissions implemented in this way before. Does anyone know of any examples where a similar concept is used?

I found a study (http://dl.acm.org/citation.cfm?id=2207728) that tested a similar concept and had promising results but I have yet to find a real-world implementation.

Answer 1

One of this issues with this approach is that you're adding in another administration area to the system: tag management. You will have to ensure that when content is uploaded it is assigned all the relevant tags, and that when new tags are identified you'll have to go through each individual photo and re-tag them one-at-a-time with the new tags.

While this is a perfectly usable approach from a user permissions management point-of-view it could escalate into a significant administration overhead from a tagging perspective.

Perhaps a better solution is to assign users into groups and then associate those groups with each image instead (or better still group the pictures together into groups / folders and assign user-groups to those users). Yes, it's a more traditional way of managing user-permissions but it could also be said that it's a tried-and-tested approach too. That way it's a lot simpler to manage when you identify new categories or want to change the user permissions.

Answer 2

The Enterprise Information Management software M-Files uses this approach to permissions management. They call it metadata-based permissions (where the tag is metadata to the document or picture) or automatic permissions.

https://youtu.be/5HqG-oQFBoA?t=124

In M-Files you can also combine both approaches, tag-based permissions and user group-based permissions. For example users in the "finance" group can see all invoices whereas users in the "project manager" group can see only invoices tagged with projects they manage and all other users can see only invoices for purchase orders they have issued.

If you tagging is up-to-date this is the way to go. User permission management is a major hassle for organisations and often it leads to a very permissive state just to keep users from bothering IT with requests for permissions.