You can model most security requirements with either decision matrixes and&#x2F;or decision trees. These matrices and&#x2F;or trees can be retrieved or calculated dynamically avoiding you from having code like: user.hasRole(&quot;Superadmin&quot;) || snip...<p>The two primary models are Access Control Lists or Role based security. You can google lots of info on these two security models.<p>In the past for enterprise&#x2F;b2b I usually build ACL security with a Role based security on top (that is the RBAC underneath is ACLs). Obviously for consumer based products this is massive overkill.