Best way to handle permissions editing towards multiple objects

Question

I am trying to figure out what would be most user friendly interface to handle permission editing towards multiple objects.

In my eyes the probably most user friendly way to handle permissions editing towards single object (user account most often) is grid/table like system where user or users are presented in rows and roles or permissions as columns with checkboxes filling the table indicating permission or role turned on or off.

That presents nice coordinate-system like interface where Y axis contains users, X axis contains permissions/roles and nobody even notices the Z axis which presents the selected account.

But lets say we have more complicated system with multiple objects that users can handle... they can be houses or vehicles or whatever. And users can have several permissions towards those objects. For example lets list simple permissions like:

• can edit object
• can delete object
• can view object

Since there can be 1-infinity amount of those objects we suddenly have this Z-axis problem. How can you switch between the objects?

Simple use cases:

I want to edit permissions of user X towards 50 objects of type Y. I then want to edit user X different permissions towards 10 objects of type Y I want to edit permissions of a role Z towards 500 objects of type Y.

Basically i see problems of scale arise. I could switch around the axis's and put user object into "invisible" axis Z, keep roles on X and put objects as rows into Y axis. But with 500 objects that list is way too long. Has anyone encountered similar problem and if you have - how have you solved it?

Alan

PS. I wanted to create new tag permissions, but i cant right now. What tag could this question use to better highlight the permissions handling?

Answer 1

Here's one way to do it, assuming that permissions are the same for each object group. (ie If User01 can edit an object under group X, then he can also edit the 500 other objects in group X).

Rather than defining role as a group of users, define the role as a group of permissions. For example:

• Role 1 (admin) can edit, delete, and view
• Role 2 (author) can edit and view
• Role 3 (viewer) can only view

Then allow a user to have a separate role per object group. For example:

• User01 can be an admin for object group X but author only on group Y
• User02 can be admin for group X and author on group Z
• User03 can be viewer for groups X, Y, and Z

When you want to allow User03 to edit group X only, then you will change his role to admin for group X and retain his viewer role in groups Y and Z.

PS I can't find an existing relevant tag to the question, as this actually seems more of an information architecture problem or data structure problem than a user experience one.