title: Non RBAC User Roles and Permissions System: a role with properties
body: <p>We are currently <strong>designing</strong> a <strong>User Roles and Permissions System</strong> in our web application (ASP.NET), and it seems that we have several <strong>cases</strong> that <strong>do no fit</strong> within the classical <strong>Role-Based Access Control (RBAC)</strong>. I will post several questions, each devoted to a particular case. This is my second question (the first question is here: <a href="https://stackoverflow.com/questions/2839797/non-rbac-user-roles-and-permissions-system-checking-the-users-city">Non RBAC User Roles and Permissions System: checking the user&#39;s City</a>).</p>
  
  <p>We have the following case: we need to implement a <strong>Manager role</strong> in our web application. However, a Manager can <strong>belong to one or several companies</strong> (within a big group of companies for which we are creating this web app). Say, there can be “Manager of companies A and B”, “Manager of company C”, etc.</p>
  
  <p>Depending on the companies that the Manager belongs, he has <strong>access</strong> to certain operations: for example, he can communicate with clients only of those companies that he belongs to. That is, “Manager of companies A and B” can only have contacts with clients of companies A and B, and not with those of company C. He can also view clients’ details pages of companies A and B and not of C, etc.</p>
  
  <p>It seems that this case falls within the RBAC. However, this is not really the case. We will need to create a <strong>ManagerRole class</strong> that will have a <strong>Companies property</strong> – that is, this will not be just a role as a collection of permissions (like in the classical RBAC), but a <strong>role with properties</strong>!</p>
  
  <p>This was just one example of a role having properties. There will be others: for example, an <strong>Administrator role</strong> that will also belong to a number of companies and will also have other custom properties.</p>
  
  <p>This means that we will a hierarchy or roles classes:</p>
  
  <pre><code>
  class Role – base class  
  class ManagerRole : Role  
      List Companies  
  class AdministratorRole : Role  
      List Companies  
      Other properties
  </code></pre>
  
  <p>We investigated pure RBAC and its implementation in several systems, and <strong>found no systems</strong> featuring a <strong>hierarchy or roles</strong>, each having custom properties. In RBAC, roles are just collections of permissions.</p>
  
  <p>We could model our cases using <strong>permission with properties</strong>, like ManagerPermission, AdministratorPermission, but this has a lot of drawbacks, the main being that we will not be able to assign a role like “Manager of Companies A and B” to a user directly, but will have to create a role containing a ManagerPermission for companies A and B… Moreover, a "Manager" seems to be rather a "role" (position in the company) rather than a "permission" from the linguistic point of view.</p>
  
  <p>Would be grateful for any ideas on this subject, as well as any experience in this field!</p>
  
  <p>Thank you.</p>