The design of privilege system based on role access control

1. role-based Permission Design

This is the most common and relatively simple scenario, but usually this design is enough, so Microsoft has designed the common practice of this scheme, which is not controlled for each operation, but in the program based on the role of the operation of the permissions to control;

2. Operational-based permission design

In this mode, each operation is recorded in the database, and the user has the right to the operation, which is also recorded in the database, and is structured as follows:

However, if you use the above design directly, it will result in a very large amount of useraction in the database, so we need further design to improve efficiency, see scenario 3

3. role-based and operational Permission design

As shown in the figure above, we have added role, and roleaction tables, so that we can reduce the records in Useraction and make the design more flexible.

But this scenario may not be flexible enough for the user's needs, for example, when a user asks for an operation on a regular employee, we need to add a new user role, but this user role is unnecessary because it is a temporary role, If you add a role and you need to remove this role when you reclaim this normal employee privilege, we need to design a more appropriate structure to meet the user's requirements for permission settings.