User Rights - Business Role, Group, Role
Comments
Completely agree that USER - ROLE mapping is bad practice. For USER - USERGROUP I would not be so strict. Let’s say it is better to start with relating over BUSINESS ROLE in ideal case but there are good reasons to create multiple USER GROUPs “inherited” from single BUSINESS ROLE’s purpose but assign users individually.
Example: BrandManager is a sales person responsible for pricing of products within the given Brand. All Brand Managers will have same rights assigned via BUSINESS ROLE, even some common objects granted via common USER GROUP “BrandManagerGroup”. But then there will also be “BrandManager-BrandA” and “BrandManager-BrandB” groups with specific access to discrete sets of objects in PFX solution. So a user will be assigned to BUSINESS ROLE and additionally to individual USER GROUP per his brand focus. Creating a brand-specific BUSINESS ROLE would be crazy overhead.
Would be good to mention/link to Entitlement logics for documents. These are rarely used although a powerfull and flexible feature.