Advanced permissions

[kfawcett]

Here's how I've designed mine.

Anyone created a RBAC and ACL system? Comments on this design?

I'm trying to determine the best approach for a RBAC and ACL system. I want to store the roles and ACLs in the DB for easy updating in the future, so I don't think I can use the Roles and Permissions feature in the Security Provider. The Security Provider will stay a simple "is the user logged in" enforcer. At the moment I'm thinking I'll need to add DB queries at the beginning of my API's Request Methods to check if the user has the appropriate rights before running any of the steps. [image] …