Before we start to implement our solution, it's important to understand these two concepts (and their synonyms). In our application (apart from actually checking the stock), we have two distinct requirements:
- Only people that are authenticated may use it. That is, as a user, you must have successfully logged into the system.
- Among people who are authenticated to use the software, only a subsection of those may be authorized to update the stock figures.
To better illustrate this, let's imagine a fictitious company and four people that are affiliated with that company; let's imagine that our company sells building supplies: we'll call it PCM Building Supplies Co..
Graham is a site manager at the company; he is responsible for everything that happens at the site, including checking that the stock levels are correct, and for ordering from...
