Kubestro » Server

Everything granted is worthless unless it is actually applied, consistently, to every way of reaching the platform, and unless the rules produce one predictable answer when several grants apply at once.

Every protected action is checked before it runs and refused clearly when it is not permitted, whether it was reached through the interface, the API, or the command line. When several grants apply, the one closest to the object decides; within one place, an entry naming the person beats one naming a group they belong to, and a denial beats an allowance. Anything not decided is refused. Administrators are never refused. A change to a role, a grant, or group membership takes effect without anybody signing in again.