We are building a web-based application which contains a bunch of images and documents, and there is a requirement to be able to restrict what images/documents a particular user can see. (It's your basic user access control stuff.)

One idea for implementing this is to make use of the tagging sytem that already exists in the application, so when creating or editing a user you will see something like this:


download bmml source – Wireframes created with Balsamiq Mockups

I think this could be quite a flexible system but I am concerned that I haven't seens user permissions implemented in this way before. Does anyone know of any examples where a similar concept is used?

I found a study (http://dl.acm.org/citation.cfm?id=2207728) that tested a similar concept and had promising results but I have yet to find a real-world implementation.

  • Not implemented yet, but we are on the verge of doing something similar for the right to execute specific queries. It is considered more intuitive to set permissions like this. However, that may only hold true as long as only "allow" permissions are used. When you add "deny" into the mix (where deny is stronger than allow and allow is stronger than unspecified), things can get very complicated very quickly. May 17, 2012 at 12:00
  • This has been implemented and works great. Check out the "super-tags" in Nimble.com. Yes, it's a CRM, but the super-tags are quite great. You can also add additional fields to an object based on tags, e.g. you give the super-tag "journalist" to a contact item and whoosh you get some additional fields to fill out that are only relevant for journalistic contacts…
    – Oliver
    Jan 1, 2013 at 20:37

1 Answer 1


One of this issues with this approach is that you're adding in another administration area to the system: tag management. You will have to ensure that when content is uploaded it is assigned all the relevant tags, and that when new tags are identified you'll have to go through each individual photo and re-tag them one-at-a-time with the new tags.

While this is a perfectly usable approach from a user permissions management point-of-view it could escalate into a significant administration overhead from a tagging perspective.

Perhaps a better solution is to assign users into groups and then associate those groups with each image instead (or better still group the pictures together into groups / folders and assign user-groups to those users). Yes, it's a more traditional way of managing user-permissions but it could also be said that it's a tried-and-tested approach too. That way it's a lot simpler to manage when you identify new categories or want to change the user permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.