I have a friend that is emphatic about the benefits of what he terms 'realm-role' security[1], which I do prefer over some of the more byzantine approaches I've

I have a friend that is emphatic about the benefits of what he terms 'realm-role' security[1], which I do prefer over some of the more byzantine approaches I've dealt with. The levels of complexity stack up on the user side too, especially if you try to accommodate wandering contexts in multitenancy scenarios. His model doesn't try to address those requirements, which may be for the best. [1] http://www.bivio.biz/bp/Realm_Role_Task/Diagram http://www.bivio.biz/bp/Realm_Role_Task/Diagram