I've been experimenting with a tree-oriented permissions assignment system. The idea is straightforward. For each branch of the tree, a user can have either all, none, or some of the permissions within that branch. Leaf nodes just need a simple yes or no. Assuming we name all the nodes of the tree according to something like a pathname, it becomes possible to represent user rights as a set of permission paths beneath which access should be granted.

I want the permission system to work as independently as possible from the applications which it controls. However, those applications might have permission structures which change with time, and I don't want to have to update the database because of a change in the permission structure of an application. A new permission might come about because of an added feature, or it might exist because of something someone did that doesn't even touch the database. For example, right now on the client site, there's a feature that relies on files in a certain folder. Each time the client adds a file to this folder, there's another subcategory of privilege that springs into existence. I should not have to duplicate the information in some database table. There is a single point of truth, and in this case, that point is not in the database.

How, then, can the permission management system access the permission structure of the applications that it plugs into?

The basic shape of the problem is that of collecting and collating configuration information from widely scattered parts of a system. Might this be the same gluey substance that weighs on all large systems? What happens the next time some feature spreads tentacles everywhere? How do I keep a growing system from becoming little more than a tangled mass of configuration tentacles?

So that's one hassle. The next, of course, is on the client side.