| 摘要 |
Architecture removes the limitation of a fixed set of roles and scopes, allows more effective permission auditing, and provides a convenient delegation model. Administrators can create roles fine-tuned to business needs without changing permissions on the resources. The new roles can be easily examined and delegated to other administrators. Moreover, scoping and delegation is simplified. This is possible because permissions are granted as a role (a unit of permission assignment is a role), which can include multiple entries. The entries correspond to end-user actions and are not related to implementation-dependent resource rights. The actions can include web services or API calls, script or executable file names, specialized commands that implement particular operation, and associated parameters, etc., essentially any action that the end-user performs.
|
