roles relation component in privileges

maybe this is somewhere else but i think i rescued it from google cache...

  This is a short explanation of a minor change to the privileges 
structure of
the roles module, and how you can take advantage of it.

The functions for adding and removing users and groups from groups have been
given a new component: Relation
What does this mean? It means that privileges on roles themselves (i.e.
reading, editing, adding etc.) and the parent/child relations between roles
can now be separate.

This means that you can now define privileges that allow your users to add
and remove users from groups, even if they cannot change the users
themselves.

The instances of the Relation component have the structure <parent>:<child>.
The privileges need the access levels ACCESS_ADD or ACCESS_DELETE to add or
remove roles from other roles. Note that because access rights are
cumulative, delete access also implies add access

Here are a couple of examples:

Realm Module Component Instance Level Explanation
----- ------ --------- -------- ------------- ----------------
---
Old (same behavior as before):
All roles All All ACCESS_EDIT Lets you edit a
role and add or remove it from other roles or others from it

Changed (used to include relations):
All roles Roles All ACCESS_EDIT Lets you edit a
role, but not add or remove it from other roles or others from it

New:
All roles Relation All ACCESS_ADD Lets you add or
remove a role from any other roles or others from it

All roles Relation Users:All ACCESS_ADD Lets you add
roles to the Users group

All roles Relation Users:All ACCESS_DELETE Lets you add or
remove roles from the Users group

All roles Relation All:foo ACCESS_ADD Lets you add the
role foo to any group

Enjoy,

Marc

(google cache of bigteeth's site)