[Zope3-dev] My take on Zope3 permissions / security.

[Lennart Regebro]

From: "Shane Hathaway" <shane@zope.com>
> Maybe so.  You just have to be sure you never store the principal IDs in
> the content objects, but instead compute the principal to role mappings
> on the fly.  (Also known as computed local roles.)  You may have been
> thinking along these lines anyway, but here's an example:
>
> Let's say I'm in a new company and I want to allow all employees to
> comment on documents in the company intranet, but only when the
> documents have been published.  My company grows and lots of document
> are added all the time.  Unfortunately, newer employees can't comment on
> older documents because their principal IDs didn't exist when the
> documents were published.  Hmm, not good.  The problem gets worse in
> larger organizations.

Yup, all roles have to be computed since the effective roles in one contet
can depend on many sources.
I haven't really thought much about how to change the permissions depending
on workflow state, I just envisioned it like different permission, but I
realize that it won't be practical.