From b6a55ed72f62882c3d72acbfc41384aeccb40948 Mon Sep 17 00:00:00 2001
From: Frederick Muriuki Muriithi
Date: Wed, 28 Jun 2023 11:15:24 +0300
Subject: Auth: Document roles can be assigned to any user.

---
 topics/authentication/authentication-authorisation-design.gmi | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'topics/authentication')

diff --git a/topics/authentication/authentication-authorisation-design.gmi b/topics/authentication/authentication-authorisation-design.gmi
index 1085980..92b396e 100644
--- a/topics/authentication/authentication-authorisation-design.gmi
+++ b/topics/authentication/authentication-authorisation-design.gmi
@@ -120,6 +120,8 @@ These demand some bureaucracy to access due to security and privacy consideratio
 
 The roles will be collections of privileges that can be assigned to users. They are the system's main way of controlling access to the system and restricting user access.
 
+Roles can *ideally* be assigned to any user, whether they are a member of the group or otherwise. This means, that a resource can be private to the group, and the resource owner can give access to the resource to (a) specific user(s) outside the group by assigning them a role that has only the privileges they need for access.
+
 ### Groups
 
 The group is the main organisational scheme for the authorisation system.
-- 
cgit v1.2.3