I'm trying to create an RBAC with Zend_Acl. The question I have is that I want users to be able to have multiple roles, but I'm not sure how to solve permission conflicts between the various roles? In cases where there is a both an allow and deny, should the allow always override the deny? As always, thanks a lot for taking out the time to check out my question. Cheers!
Think of it like your home.
Let's say you have bad feeling about Russians. Would you think, that you should deny your good friend access to your home just because he is a Russian? No. He has proven some quality that granted him the "friend" status. The allow should override the deny IMO.
No offense to the Russians :P