ACL's Permissions and Business Logic

Question

I would like to know where people draw the boundary between assigning permissions to a user in a muliti user appliction and the business logic.

For example if a user can have permission to access a number of cars do you assign these permissions directly through the user class by adding them to a collection of car objects on the user or do you assign them in the ACL and use the ACL to retrieve the list of cars that the user has access to?

Are there any guidelines for when you should use the ACL for this sort of thing and when it should be part of the business logic?

Answer 1

Normal practice is "role based security".

For instance you might set up two roles "salesperson" and "maintainence".

"salesperson"s would have permision to drive,refuel and park a set of cars.

"maintenance"ers would have permision to drive, service and repair the set of cars.

You would than allocate your employees to one or other of the roles.