If I am reading this right users are the same as current with an optional list of employees to select from (could be AD integrated for the list, an HR employee source or none)
What he is doing is creating a series of abstract rolls (which would need to be added to each control, page tab and so on.) A great deal of planning would be needed as to how many you would need and which is granted access to a given control.
But the great idea he has here is that both who is a member of the abstract role and what controls are allowed access by the abstract role are all configurable at runtime by an admin as two other sub groups one for the people and one for the controls or objects. With no limit to how many of each are in each of the two sub groups or even what they are at development time.
In other words adding a new sub role group or sub user group to a control requires no recoding. Again if I am reading this right the resource tree is like a make – model – year flat table using a simple tree control or dropdowns that update each other.
As a sub note this could be even be made recursive and allow groups to be members of groups.
My hats off to you SA.D, great idea, in a simple db view with no code needed other than the admin screens to manage it.
Chronus101 – There is no path needed to any control dream up your own, it is simply a table entry that you can put together anyway you like, and select into the many to many join table to make it a part of the sub group.
Michael – No code needed to make this work.