put a rule on an attribute def so that if a user comes out of a group, the user will have disabled dates from
a role which has permissions or removed assignments directly to the user
put a rule on an attribute def so that if a user comes out of a group, the user will be removed from
a role which has permissions or removed assignments directly to the user
this takes a permissions assignment (PermissionEntry), and
gives it a score so you can find the best entry, even if it is
a tie, to decide if allow or deny.
if processing permissions, you can filter out either redundant permissions (find best in set),
or do that and filter out redundant roles (if flattening roles) (find best in set)