Kubestro » Server

Roles and groups are only useful once access can actually be handed out: platform-wide by an administrator, and on a single object by whoever owns it. Someone sharing their own server should be able to pick a ready-made role or hand-pick exactly what the other person may do, and should be able to shut one person out of something the rest of their team may do.

Access is given by granting, to a user or a group, either a role or a hand-picked list of permissions, applying either across the whole platform or to one object, and either allowing or denying. Nobody can hand out access they do not hold themselves.