Drupal 7 Module Development

Chapter 9
It is a good idea to write out such rules and review them with the project sponsor,
because doing so can reveal the implications of applying the logic you have defined.
In this case, rule #4 becomes key, because we will explicitly deny access to edit
content, even for users who might have the edit any Article content permission.
Doing so might lead to confusion for some users, so we should ensure that this is the
rule that we want.
We should point out, from a security perspective, that these rules will
place all 'authenticated users' into the same group. This behavior may be
desirable, or it may open a risk that all registered site users can edit all
content. For the purpose of our demonstration module, let's assume that
this behavior is desired, and that users who need their content protected
will be given an additional role.
Since this is the behavior we want, the functionality is pretty easy to enforce. Let's
create a role_edit.module file for this behavior. Our module starts out much like
the Delay module.