Question

We are using a party model for a booking application, so that customers and staff effectively share the same table in the database.

Previously customers could only ‘book’ an appointment if they paid and if a slot was available. Now, we want to create a premium_customer type role so that customers can make bookings without paying and even if there is no availability.

Does it make sense to add customers to a single security model, such as in an ACL or RBAC?

• If so, do we introduce roles called normal_customer and premium_customer alongside our reception and duty_manager and other staff roles?
• If not, should there be a separate security model for website users?

Answer 1

yes it is fair to create another role to record premium customer