Drupal 7 Module Development

Drupal Permissions
and Security
Permissions lie at the center of Drupal's security paradigm. Simply put, permissions
determine who can perform what action on a website. Most commonly, permissions
allow users to gain access (or be denied access) to specific features, such as access to
the site-wide contact form or the ability to change the author of a piece of content.
These permissions are not assigned to individual users, but instead to classes of users,
defined as roles. A role is a collection of permissions. Individual users may then be
assigned to one or more roles, as is appropriate to your project's business rules.
Note: When assigning permissions to roles, the default "authenticated
user" role is a special case. Any permission granted to this role will also be
granted to any other role except "anonymous user". Why? This is because
the act of logging in to a user account defines a user as "authenticated".
Custom roles created for a site inherit the base permissions assigned to
the "authenticated user" role users.
Understanding this behavior is critical to site builders, making it crucial
for module developers. You may need to create very specific permissions
in order to satisfy the business logic that your module requires. In our
discussion, we will explore common problems that can occur when
permissions are too broad or too narrow.
Any module may establish new permissions. In this chapter, we will discuss best
practices for security and usability when defining your module's permission options.