We are building a web-based application which contains a bunch of images and documents, and there is a requirement to be able to restrict what images/documents a particular user can see. (It's your basic user access control stuff.)

One idea for implementing this is to make use of the tagging sytem that already exists in the application, so when creating or editing a user you will see something like this:


download bmml source – Wireframes created with Balsamiq Mockups

I think this could be quite a flexible system but I am concerned that I haven't seens user permissions implemented in this way before. Does anyone know of any examples where a similar concept is used?

I found a study (http://dl.acm.org/citation.cfm?id=2207728) that tested a similar concept and had promising results but I have yet to find a real-world implementation.

  • Not implemented yet, but we are on the verge of doing something similar for the right to execute specific queries. It is considered more intuitive to set permissions like this. However, that may only hold true as long as only "allow" permissions are used. When you add "deny" into the mix (where deny is stronger than allow and allow is stronger than unspecified), things can get very complicated very quickly. May 17, 2012 at 12:00
  • This has been implemented and works great. Check out the "super-tags" in Nimble.com. Yes, it's a CRM, but the super-tags are quite great. You can also add additional fields to an object based on tags, e.g. you give the super-tag "journalist" to a contact item and whoosh you get some additional fields to fill out that are only relevant for journalistic contacts…
    – Oliver
    Jan 1, 2013 at 20:37

2 Answers 2


One of this issues with this approach is that you're adding in another administration area to the system: tag management. You will have to ensure that when content is uploaded it is assigned all the relevant tags, and that when new tags are identified you'll have to go through each individual photo and re-tag them one-at-a-time with the new tags.

While this is a perfectly usable approach from a user permissions management point-of-view it could escalate into a significant administration overhead from a tagging perspective.

Perhaps a better solution is to assign users into groups and then associate those groups with each image instead (or better still group the pictures together into groups / folders and assign user-groups to those users). Yes, it's a more traditional way of managing user-permissions but it could also be said that it's a tried-and-tested approach too. That way it's a lot simpler to manage when you identify new categories or want to change the user permissions.


The Enterprise Information Management software M-Files uses this approach to permissions management. They call it metadata-based permissions (where the tag is metadata to the document or picture) or automatic permissions.


In M-Files you can also combine both approaches, tag-based permissions and user group-based permissions. For example users in the "finance" group can see all invoices whereas users in the "project manager" group can see only invoices tagged with projects they manage and all other users can see only invoices for purchase orders they have issued.

If you tagging is up-to-date this is the way to go. User permission management is a major hassle for organisations and often it leads to a very permissive state just to keep users from bothering IT with requests for permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.