Permissions in Platform form one of the most advanced permission= s systems around, allowing you to define very fine-grained rights for your = Editors, Visitors, Members and other users.
In the permission system a User by default does not have access to anyth= ing. To get access they need to inherit Roles, typically assigned to the Us= er Group they belong to.
First part of the permission model is the Roles, and they consist of the= following parts:
RoleLimitation *- RoleAssignment >- Role -< Policy -*< Limita= tion
Second part of the model is made up of Users and User Groups:
User -*< UserGroup
Last part on the permission model is the fact that Role assignments can = be assigned to both Users and User Groups:
User - RoleAssignment - UserGroup
Best Practice
Best practice is to avoid assigning Roles to Users directly, and instead= to make sure you model your content (types, structure, sections, etc.)= in a way that can be reflected in generic roles. Besides being much e= asier to manage and keep on top of security-wise, this also makes sure your= system performs best. The more Role assignments and complex Policies y= ou add for a given User, the more complex the search/load queries powering = the whole CMS will be, as they always take permissions into account.
Two parts of the permissions system are extensible from a programmatic p= erspective: Policies and Limitations