Talk:How permissions are calculated

Silly comment but "..by working through the table in normal reading order, right to left, top to bottom.." shouldn't be left to right ? --Eloy Lafuente (stronk7) 16:01, 20 March 2009 (UTC)

Doh!--Tim Hunt 11:10, 22 March 2009 (UTC)

"Inherit"

I've been planning to read this page for a long time and found it very helpful. However I would suggest 1. the link between "not set" and "inherit" (as used in the page) is not made explicitly at any point. So when it says, "When you override permissions, only use permissions Allow and Prevent where you actually need them. Leave everything else set to inherit." it could be more apparent that this actually means "Leave everthing else set to "Not set". 2. In the paragraph "Does this calculation make sense?" is it worth adding a 3rd bullet, along the lines of "In many cases, neither of the above will be the case. In which case, the capability (if not set elsewhere) is Not allowed. --Dave ches 16:01, 07 February 2010 (UTC)

Prevent vs. Prohibit

This page is the closest I've been able to find which defines the difference between "Prevent" and "Prohibit" -- and it's only alluded to in passing. A clearer definition would be welcome. --Donna Hrynkiw 17:41, 16 March 2011 (UTC)

A prohibit is a total ban. If the user has a prohibit for a capability, then no other role assignment or override can let them do that thing. The classic example of this is where you want to make a 'Naughtly student' role. The idea is that if a student starts posting inappropriate things in forums, you can assign this role until you have talked to them and told them to stop. You do this by setting mod/forum:post to prohibit in the naughty student role. The prohibit means that no matter what other roles the student has, you can be sure they will not be able to post to forums until you unassign the Naughty student role.

It is much more common to use prevent. That stops the user doing the thing, but you can override it in a specific place using a role override. Actually when defining roles, you should normally just use Allow and Not set. You user prevent when doing override permissions, and the role has allow in a higher context.--Tim Hunt 19:11, 16 March 2011 (UTC)