User Authorization - permissions within roles

[dean]

I'm developing a new application that will incorporate the notion of user roles, e.g. admin,reporter,viewer.

I'm thinking of doing this using the GenericIdentity and GenericPrincipal, however I would like more fine grained permissions such that under each role (e.g. reporter) I can have more permissions (e.g. Can report critical issues, can report trivial issues, there's loads of others)


Is the best way to do this to create a userrole for each permission, rather than user type, and add these to the PrincipalObject. Or should I abandon the Identity/Principal idea and just have a set of permissions in my relation database and query those..

Thanks in advance for any tips or suggestions ...