Permissions in Platform form one of the most advanced permissions systems around, allowing you to define very fine-grained rights for your Editors, Visitors, Members and other users.
In the permission system a User by default does not have access to anything. To get access they need to inherit Roles, typically assigned to the User Group they belong to.
First part of the permission model is the Roles, and they consist of the following parts:
RoleLimitation *- RoleAssignment >- Role -< Policy -*< Limitation
Second part of the model is made up of Users and User Groups:
User -*< UserGroup
Last part on the permission model is the fact that Role assignments can be assigned to both Users and User Groups:
User - RoleAssignment - UserGroup
Best practice is to avoid assigning Roles to Users directly, and instead to make sure you model your content (types, structure, sections, etc.) in a way that can be reflected in generic roles. Besides being much easier to manage and keep on top of security-wise, this also makes sure your system performs best. The more Role assignments and complex Policies you add for a given User, the more complex the search/load queries powering the whole CMS will be, as they always take permissions into account. |
Two parts of the permissions system are extensible from a programmatic perspective: Policies and Limitations