This really doesn&#x27;t satisfy real world usage.<p>Let&#x27;s say I&#x27;m on github and I have a number of repositories. I want admin access over my area, the power to create and delete repositories. I do not want other people to be able to create and delete repositories.<p>And then I lastly want to be able to have access control over some repositories completely (private repositories).<p>How can you have authorisation that means that I get to sometimes create and delete repositories, that other people can have some permissions for, without having more than 2 levels of authorisation?<p>Just saying &quot;groups&quot; is just hand-waving the question away, all the complexity of role-based vs attribute based authorisation is hidden in &quot;use groups&quot;.