We are getting ready to go live with OAR in November. I've designed our security roles to have a base role of 'Staff' which has all the common permissions in Access Control (SAC) that everyone needs, and then supplementary roles such as Support, Coordinators, Finance, Manager where I grant select additional permissions.
Up to this point, I've always believed that these roles are cumulative (like every other security model I've worked with in the last 20 years) so that if a user was part of Staff & Support, then they'd get the permissions from both roles. So, if Staff has View rights, but no Update rights, and Support has Update rights and no View, then that user would have both View and Update rights.
We've been having some misc. permissions issues with Reviews, and the developer we're working with believes that if both roles don't have ALL permissions needed, that it won't work properly and that's what's causing the issues.
Can anybody confirm if the SAC permissions are cumulative or not? I'd rather not need to set up and maintain all the permissions for every role if not needed, it's rather time consuming.
