Permissions in "Platform stack" is one of the most advance permi= ssions systems around, allowing you to define very fine grained rights for = your Editor-, Anonymous-, Member-, ... Users.
In the Permission system by default a user does not have access to anyth= ing, to give them access, they need to inherit Roles, typically assigned to= the User Group they belong to.
First part of the Permission model is the Roles, and they consists of th= e following parts:
RoleLimitation *- RoleAssignment >- Role -< Policy -*< Limita= tion
Second second part of the model is Users and User Groups:
User -*< UserGroup
Last part on the permission model is the fact that RoleAssignments can b= e assigned to both User or UserGroup:
User - RoleAssignment - UserGroup
Best Practice
Best practice is to avoid assigning Roles to Users directly, and instead= make sure you model your content (types, structure, sections, ..)= in a way that can be reflected in generic roles. Besides being much easier= to manage and keep on top of security wise, this also makes sure your syst= em performs best. The more Role assignments and complex policies you ad= d for a given user, the more complex the search/load queries powering the w= hole CMS will be, as they always take Permissions into account.
Two parts of the Permissions system is extensible from a programatic per= spective: Policies and Limitations
Further reading: Lim= itations reference