Unfortunately (and as you know) the world is more complex than this and, in some cases, you will not meet legal requirements.  Yes, what you suggested is _a_ best practice; however, I&#x27;d suggest some of the more &quot;standard&quot; directions would be (for example) a standard RBAC design (similar to those from NIST or  Ferraiolo &#x2F; Kuhn 1992 or INCITS CS1.1 standards update 2012).