It can be role based, so you could still have one role for all users, such as view and insert only for a forum. But our solution has an interesting twist: secu

It can be role based, so you could still have one role for all users, such as view and insert only for a forum. But our solution has an interesting twist: security is managed like queries. For example, taking a sports social network, a team's messages can be sent [an insert] by team members, but seen [view rights] by members of the team and their friends. This is all set with two statements. It makes it so that you can go more often just directly to the database.