Imagine a system which has a number of functions and a number of users. A user must have rights to a specific function. Users may belong to a group. A group may belong to a group.So as a simple illustration, user A has rights to function 1 and 2. User b has rights to function 2 and 3.User A is in group1 which has rights to function 3, but negative, i.e. explicit denied access to function 1.For extra complexity, perhaps the function has default rights. So you can say, but default everyone has access to function a, or no one has access to function a. I guess it's the same as having an Everybody group.So the question is how are you managing user rights? Do you make all rights additive? Do you allow the explicit denied I mention at the end? Do you have a system where the most access possible is granted or the least? Do you make user rights trump group rights, or vice versa?I've seen a number of variations for applying rights. I'm now defining my own and I'm really looking for any experience you have in that area where you wish you'd done something different, or were delighted you chose a particular way of doing things.Thanks
Coding user rights
access control
Do you make all rights additive? Do  you allow the explicit denied I  mention at the end? Do you make user  rights trump group rights, or vice  versa?These are really requirements questions.  Talk it over with whoever owns the project and discuss the implications with them, then code what you and they decide is best for the project.Do you have a system where the most access possible is granted or the least?This is easier to give a solid answer to.  The Principle of Least Privilege states that the system is most secure when no one has access to anything they don't actually need.  This is a pretty well-understood principle that's been tested in real-world security for decades, and it makes a good guideline to go by.