He who permissions least, permissions best

posted by  jhorra (5)  15 months ago (blogs.msdn.com)

I've heard a few questions and comments about our permission model recently. For example, some folks have asked why user in two groups, one granted a permission and one denied the same permission, is denied the permission rather than granted it. The answer lies in our permissioning model.

Lets first define a few terms to get us all on the same page. Note that these are not necessarily official terms, they're just the terms I've used when discussing permissions with folks on the team here:

• Identity: A user or group that may be used with the permis