TABLE OF CONTENTS Role hierarchies are a natural means of structuring an organization's line of authorities. Support for hierarchical roles therefore is a key aspect of any role-based access-control implementation. Mathematically, a role hierarchy defines a partial ordering relationship among roles ( ROLES ROLES) denoted by the symbol ?. Each pair of related roles (i.e., r 1, r 2 ? ROLES) such that r 1 ? r 2 is characterized by the following properties:
q r 1 is referred to as a senior role with respect to r 2.
q r 2 is referred to as a junior role with respect to r 1.
qr 1 acquires the permissions of r 2 in addition to its own permissions. This implies that the permission set assigned to r 2 is a subset of that assigned to r 1.
qr 2 acquires user membership of r 1 in addition to its own base of users. This means users with the senior role r 1 are automatically a subset of users in the junior role r 2.
Figure 8.3 illustrates the containment relationships corresponding to two hierarchical roles r 1 and its junior role r 2. Note the containment property with respect to users and permissions results in the senior user membership being part of the junior user membership, while the junior permissions are part of the senior...
