Access Control List Authorization

[A-Legg]

Interesting approach here but feels like a lot of work

How does everyone handle resource level permissions?

I recently implemented access control in a Ruby app. The approach would be similar to how I’d go about it in Elixir. We used an access control list model with a database table per resource. So x_acls y_acls, etc. Each access to the particular object would either verify access with a database lookup, or provide a list query with a join (so data you can’t access isn’t returned). We had various access levels, so used a bit field for that. The implementation was pretty much what you’d expect based …