<p>I can't help you with your CMS, but a very good place to read about the logic of access control is Deepak Garg's PhD thesis, <em><a href="http://www.mpi-sws.org/~dg/papers/thesis.pdf">Proof Theory for Authorization Logic and Its Application to a Practical File System</a>.</em></p>

CC BY-SA 3.0
2011-11-09T12:57:51.213Z
I just barely begun reading it, but it seems to fit my needs. At least it has already identified and "nomenclatured" a large part of concepts I use without having a name for them. Helps me get a clearer picture. Thanks!
Xananax
CC BY-SA 3.0
2011-11-05T18:12:50.487Z
2011-11-05T18:12:50.487Z
Neel Krishnaswami
<h1>TL;DR:</h1>

<p>I am looking for theoretical sources about the different manners to implement user access control.</p>

<h1>Long version</h1>

<p>I have almost finished all the stand-alone tools needed in my CMS.</p>

<p>I am not at the moment where I need to bring all these pieces together.
Now what I would like to is to create a CMS (and an API) that is completely user-centric.
This means a very strong, yet easy to use, rights management framework at the base of everything. A bit like unix/linux filesystems work (not the actual implementation, but in the sense that they are at the very core of the system).</p>

<p>This framework would need to account for special cases ("user can access this data until date x"), and implement per-action, or per-item rights ("user can edit <em>articles</em>, but not article233"), be completely abstract (not tied to any particular database), and not tied to any authentication system. Also, since any request would go through it, it needs to be quite optimized. Lastly, I want to keep it open for modularity.</p>

<p>This is quite a large project, and before getting into it, I'd like to gather as much theory about used rights management. I know about ACL (and have already implemented a few custom systems myself), but I am looking for a more abstract, high-level document, ideally, not tied to a particular language. In the article/book I envision, code samples would be rare, a few lines only, and coded in pseudo-code just to illustrate a point.</p>

<p>I've been looking on the net but can only find tutorials about how to implement ACL, or discussions about role-based access control, but nothing about, say, research in the field, innovative/alternative solutions, etc.</p>

<p>Anyone can advise a good book/webpage/resource about that?</p>

CC BY-SA 3.0
2011-11-04T21:11:10.340Z
It seems like a Software Engineering and HCI question and doesn't seem to me that the question is related to *theoretical computer science*. Could you please clarify why this is in the scope of cstheory? (Please check the FAQ to understand the scope of cstheory.)
Kaveh
CC BY-SA 3.0
2011-11-04T21:23:16.940Z
Maybe you are correct as this does not involve mathematics. However, I feel since I am really asking for research on the matter and not examples or tutorials, I figured the people browsing csTheory would be most apt to answer. If you think the question does not apply, then I am sorry for wrong posting, and feel free to close it.
Xananax
CC BY-SA 3.0
2011-11-04T23:01:43.870Z
I think programmers.SE (whose scope includes Software Engineering questions) and proposed site for HCI would be more appropriate places for this question. To me this seems off-topic for cstheory.
Kaveh
<relational-structures>
Theory of user control systems?
Xananax
# Theory of user control systems?

(Asked by: username_0 on 2011-11-04)

# TL;DR:

I am looking for theoretical sources about the different manners to implement user access control.

# Long version

I have almost finished all the stand-alone tools needed in my CMS.

I am not at the moment where I need to bring all these pieces together.
Now what I would like to is to create a CMS (and an API) that is completely user-centric.
This means a very strong, yet easy to use, rights management framework at the base of everything. A bit like unix/linux filesystems work (not the actual implementation, but in the sense that they are at the very core of the system).

This framework would need to account for special cases ("user can access this data until date x"), and implement per-action, or per-item rights ("user can edit *articles*, but not article233"), be completely abstract (not tied to any particular database), and not tied to any authentication system. Also, since any request would go through it, it needs to be quite optimized. Lastly, I want to keep it open for modularity.

This is quite a large project, and before getting into it, I'd like to gather as much theory about used rights management. I know about ACL (and have already implemented a few custom systems myself), but I am looking for a more abstract, high-level document, ideally, not tied to a particular language. In the article/book I envision, code samples would be rare, a few lines only, and coded in pseudo-code just to illustrate a point.

I've been looking on the net but can only find tutorials about how to implement ACL, or discussions about role-based access control, but nothing about, say, research in the field, innovative/alternative solutions, etc.

Anyone can advise a good book/webpage/resource about that?

**Tags:** relational-structures

> **Comments:**
> **username_1**: It seems like a Software Engineering and HCI question and doesn't seem to me that the question is related to *theoretical computer science*. Could you please clarify why this is in the scope of cstheory? (Please check the FAQ to understand the scope of cstheory.)  
> **username_0**: Maybe you are correct as this does not involve mathematics. However, I feel since I am really asking for research on the matter and not examples or tutorials, I figured the people browsing csTheory would be most apt to answer. If you think the question does not apply, then I am sorry for wrong posting, and feel free to close it.  
> **username_1**: I think programmers.SE (whose scope includes Software Engineering questions) and proposed site for HCI would be more appropriate places for this question. To me this seems off-topic for cstheory.  

---

## 1 answers

### Answer by username_2 on 2011-11-05. Score: 5 | Accepted answer

I can't help you with your CMS, but a very good place to read about the logic of access control is Deepak Garg's PhD thesis, *[Proof Theory for Authorization Logic and Its Application to a Practical File System](http://www.mpi-sws.org/~dg/papers/thesis.pdf).*

> **Comments:**
> **username_0**: I just barely begun reading it, but it seems to fit my needs. At least it has already identified and "nomenclatured" a large part of concepts I use without having a name for them. Helps me get a clearer picture. Thanks!  

---

