I am trying to figure out what would be most user friendly interface to handle permission editing towards multiple objects.

In my eyes the probably most user friendly way to handle permissions editing towards single object (user account most often) is grid/table like system where user or users are presented in rows and roles or permissions as columns with checkboxes filling the table indicating permission or role turned on or off.

That presents nice coordinate-system like interface where Y axis contains users, X axis contains permissions/roles and nobody even notices the Z axis which presents the selected account.

But lets say we have more complicated system with multiple objects that users can handle... they can be houses or vehicles or whatever. And users can have several permissions towards those objects. For example lets list simple permissions like:

  • can edit object
  • can delete object
  • can view object

Since there can be 1-infinity amount of those objects we suddenly have this Z-axis problem. How can you switch between the objects?

Simple use cases:

I want to edit permissions of user X towards 50 objects of type Y. I then want to edit user X different permissions towards 10 objects of type Y I want to edit permissions of a role Z towards 500 objects of type Y.

Basically i see problems of scale arise. I could switch around the axis's and put user object into "invisible" axis Z, keep roles on X and put objects as rows into Y axis. But with 500 objects that list is way too long. Has anyone encountered similar problem and if you have - how have you solved it?


PS. I wanted to create new tag permissions, but i cant right now. What tag could this question use to better highlight the permissions handling?

  • as to the tag, I don't think this is specifically a permissions problem -- the same UI/UX issues would arise if you had a different small set of properties (living/dead? valid/invalid? approved/denied? etc) you were managing.
    – jlarson
    Commented Jan 13, 2013 at 19:31
  • Perhaps could you perhaps point me towards better tag then that would attract more attention :)
    – Zayatzz
    Commented Jan 13, 2013 at 19:45
  • i don't know... i'm new here :) However, if you took some time to mock up a straw man (that you know won't work but is some of the way there) it might make this question less daunting to potential answerers (answerees?)
    – jlarson
    Commented Jan 13, 2013 at 20:14
  • Think you're going down the wrong path here. Editing policies where X users can or cannot do Y things on Z objects creates 2^(XYZ) combinations. Give folks the opportunity to create policies that can be applied to groups of users and groups of objects. Commented Jan 13, 2013 at 21:08
  • Yes you are absolutely right and i sort of touched that subject there by mentioning roles - which are groups of users. And yes i could create groups of objects too. But would that eliminate the issue of switching users(or roles) / objects(or groups of objects).
    – Zayatzz
    Commented Jan 13, 2013 at 21:43

1 Answer 1


Here's one way to do it, assuming that permissions are the same for each object group. (ie If User01 can edit an object under group X, then he can also edit the 500 other objects in group X).

Rather than defining role as a group of users, define the role as a group of permissions. For example:

  • Role 1 (admin) can edit, delete, and view
  • Role 2 (author) can edit and view
  • Role 3 (viewer) can only view

Then allow a user to have a separate role per object group. For example:

  • User01 can be an admin for object group X but author only on group Y
  • User02 can be admin for group X and author on group Z
  • User03 can be viewer for groups X, Y, and Z

When you want to allow User03 to edit group X only, then you will change his role to admin for group X and retain his viewer role in groups Y and Z.

PS I can't find an existing relevant tag to the question, as this actually seems more of an information architecture problem or data structure problem than a user experience one.

  • In most (web) frameworks the role is defined as group of users and im not looking to change that. That does not mean that i can not use your approach though. Main idea that i get from comments and this response seems to be that i should also group the objects which permissions im handling. And good news is that i have already done that. I'll think about it. Thanks.
    – Zayatzz
    Commented Jan 15, 2013 at 6:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.