I've been racking my brain over this, and haven't had any luck in finding existing use cases similar to mine.
I'm implementing the front-end for our website reporting software. We've got some legacy issues to deal with. The biggest issue is that the old version of the application forced users to separately login as different "accounts" to view data.
The "accounts" are more like networks, where we have Corporate, Regional and Location 'networks' nested, with "Location networks" containing the actual items which encapsulate the tracked data. I'm being vague because for some reason my bosses aren't fond of talking about behind the scenes processes publicly...
With the new system we've moved to a user-based login keyed off of their email address. A user login can have access to many Networks/Items with varying levels of access roles possible for each.
Right now we are using a tree control to allow filtering down Accounts for reports and it works great.
Where the trouble is, is in creating the front end for the management of A. Sharing access to accounts and B. Setting the access role restrictions on those shared accounts.
The tree can go 4 levels deep, and there are 9 unique access roles that are required, with more probably needed in the future as we roll more of the old features in to the new app.
Here are some options I came up with, but they each have their own pros and cons:
Account Based Access Set up
This seemed like the most obvious way to do it. I'm running in to the trouble where you may have User access on 2 Corporate Networks, but only 3/9 other access roles on one, and a seperate 4/9 access roles on the other one. In our system, you can only grant access roles that your own account has as well. So what roles do I show next to it? Each account is stored in the database seperately also, so how do we regroup them up? Also, it's possible to create conflicting access groups this way.
Role Based Access set up
Role based access set up removes the problem of conflicting access groups, but then it can get complicated if a user needs many roles... Also, not sure if this would confuse users.
Table Based Access set up
Due to spam restrictions I can't post this as a link but use the same imgur URL and add /Jbudh.png to the end of it.
Tables are easy for our users to understand... but the developer seems to think this could be trouble to reconcile when saving to the database since conflicting access groups could be created again...
How would you solve this problem?