What I am recommending <i>is</i> an established best practice: YAGNI or perhaps KISS. When I meant something simple, I didn&#x27;t mean to throw away the whole authorisation abstraction. I do consider things like role&#x2F;permission based authorisation relatively simple as long as the whole logic doesn&#x27;t live in a database a la <a href="http:&#x2F;&#x2F;blog.bronto.com&#x2F;wp-content&#x2F;uploads&#x2F;2014&#x2F;10&#x2F;imagecache&#x2F;blog-full-colum&#x2F;magento-21.png" rel="nofollow">http:&#x2F;&#x2F;blog.bronto.com&#x2F;wp-content&#x2F;uploads&#x2F;2014&#x2F;10&#x2F;imagecache...</a>.