title: What is the best way to manage permissions for a web application - bitmask or database table?
body: <p>I'm considering the best way to design a permissions system for an "admin" web application. The application is likely to have many users, each of whom could be assigned a certain role; some of these users could be permitted to perform specific tasks outside the role.</p>
  
  <p>I can think of two ways to design this: one, with a "permissions" table with a row for every user, and boolean columns, one for each task, that assign them permissions to perform those tasks. Like this:</p>
  
  <pre>
  User ID          Manage Users     Manage Products     Manage Promotions     Manage Orders
  1                true             true                true                  true
  2                false            true                true                  true
  3                false            false               false                 true
  </pre>
  
  <p>Another way I thought of was to use a bit mask to store these user permissions. This would limit the number of tasks that could be managed to 31 for a 32-bit signed integer, but in practice we're unlikely to have more than 31 specific tasks that a user could perform. This way, the database schema would be simpler, and we wouldn't have to change the table structure every time we added a new task that would need access control. Like this: </p>
  
  <pre>
  User ID          Permissions (8-bit mask), would be ints in table
  1                00001111
  2                00000111
  3                00000001
  </pre>
  
  <p>What mechanisms have people here typically used, and why?</p>
  
  <p>Thanks!</p>