Question

I have come into the habit of hand-sketching various diagrams for software I create. My software is mostly for the web. I use E-R diagramming for the data logic (model of MVC) , and a personally invented diagram style for the interactions -- what pages lead to which other ones and what do they do, i.e. the views & controllers of MVC. This allows me to simplify the important concepts, eliminate the inconsistencies and highlights problem areas that need further investigation.

Now, I ve been starting to look at an application that requires a fairly complicated system of permissions. Not really "big" -- just complicated -- with several permission "dimensions" where some permissions need to be created on the fly, and some be static.

I find myself wishing there was some simple way to diagram the permissions system, so that I can get the ideas out of my head in a clear form, and make sure there are no inconsistencies. Hence my question:

Has anybody seen/used any method of modeling permissions in a visual diagram?

Answer 1

The ls command uses color to denote permissions.

Also I would think on a whiteboard or powerpoint, that since permissions link groups of users to files, that lines between the two or spatial grouping becomes a possibility.

Answer 2

I would model:

my users with their attributes on the one hand
my resources with their attributes on the other

Identify the key attributes (building blocks). Then start writing bullet-point rules e.g.:

managers in finance can approve up to X
managers in HR can edit employee records...
employees in HR can approve new accounts

What you re doing is building your authorization policies. Then you can consider factoring out parameters e.g. the department attribute / value.

From there, you want to build a tree/flow where the root would be the entry point, the level below would be the departments, the level below other attributes...

Example:

If the user is in purchasing{}
Else if the user in finance{}
Else if...

(but in a graphical tree-based way).

I use XACML for authorization which is policy/tree-based. You can then apply CSS to it (or XSLT) to get a graphical sense of the authorization. Check out my blog for samples: http://www.webfarmr.eu/2010/11/xacml-102-pimp-my-xacml-css/

友情链接