Re: Re[6]: Understanding Privileges

There is an error in the tree in the rfc. It should read lik this:

            ReadAll                  "assign DeleteExamples to FOO"
            |
            |--DeleteExamples
               |                     Privileges assigned: DeleteExamples
               |--AddExamples                             AddExamples
                  |                                       EditArticles
                  |--EditArticles                         AddArticles
                  |
                  |--AddArticles


> as per my understanding, after winnowing, priv. tree will become as:
>
>             ReadAll                  "assign DeleteExamples to FOO"
>             |                         Privileges assigned: AddExamples
>             |--AddExamples                                 AddArticles
>                |
>                |--AddArticles
>
> Isn't it?

This is correct. Please note that currently the winnowing process as
described in the rfc has been deactivated in favor of  simpler approach,
which can be summrized as follows:

"All the privileges assigned to a role, along with their subprivileges, are
compared with each other, and those that are trumped by others are
discarded".

Marc