Roles, attributes and the roles × actions matrix
Permissions written as sentences leave gaps that developers fill as best they can. This lesson teaches you to build your product's permissions matrix, defining how far each right reaches, to choose between fixed roles, attributes and custom roles, and to set the principles that keep it enforced on the server.
Lesson objective
By the end of this lesson, you will be able to build your product's roles × actions matrix, with the scope of each right (whole account, an area, their own items), choose between fixed roles, attributes and custom roles, and write the server-side enforcement rules (deny by default, least privilege).
Topics covered
- permissions matrix
- RBAC
- ABAC
- roles and permissions
- least privilege
In the glossary
Where it fits
Deciding who can do what
How do you design clear roles and permissions, and guarantee that no customer sees another's data?
Lessons in this module
- Roles, attributes and the roles × actions matrix (this lesson)
- Isolation between customers, invitations, audit and account deletion
What you will learn in this module
This lesson is part of the course Design authentication and permissions for a product
- Design a permission model (roles, attributes, scope) as a roles × actions matrix, enforced on the server side according to least privilege.
- Specify isolation between customers, invitations, the audit log, support access and account deletion.
Related courses
- Product ManagementAdvancedRegular practice: you already use the tools or work on this topic.
Git for PMs: ship as a team without putting production at risk
3 hr 30 min
- Tech for PMsAll levelsNo prerequisites: accessible to everyone.
Explain how a web product works, from browser to server
2 hr 30 min
- Tech for PMsJuniorSome basics are useful: introductory knowledge of the topic.
Design and test an API integration as a PM
3 hr