Defining authorisation rules as part of your application sounds fine to me. Aim for making compilation and deployment of your application trivial.<p>Sounds like you want a linear hierarchy of roles. Attaching a number to each role and making rules based on that number might be all you need. For example:<p><pre><code>  Superadmin : 100
  Admin      : 90
  Manager    : 80

  if (a.number &gt; b.number) a can delete b</code></pre>