Adding user-level policies
If we want to create custom user and role policies, then the most confusing choice is the choice of user template to pick. This template creates a role and user domain with a specific purpose in mind, and grants a number of permissions by default:
Figure 15.1 – Relationship between user domain templates
The most common templates to pick for user/role policies are the following:
userdom_restricted_user_template()for (by default) unprivileged end user roles.userdom_admin_user_template()for (by default) highly privileged end user roles.
The other templates can be used as well, especially if more fine-grained controls over the roles and user domains are needed. Note, however, that the privileges assigned by the templates are mentioned as by default. If we want to create a role and user domain for administrating a specific service, then we do not want to use userdom_admin_user_template(), as this will grant...
