Authorization via permissions and roles

TDV uses a combination of resource-based privileges and resource-agnostic rights, but has no ability to explicitly authorize particular operations.  So if one wants to allow a user to perform backup operations, but not to inspect the contents of repository metadata, there is no combination of rights and privileges that will allow that.  Thus, under the current authorization system, it's easy to wind up in situations where users are given excess authorization.

To address this, TDV could have a set of named permissions, each authorizing a particular operation on the server.  Users should be able to bundle up groups of these permissions into explicitly assignable roles (as well as having some roles come pre-defined).  Permissions (and thus, roles) should also be able to be constrained by resources, as well.  Thus, for example, a developer might be given full access to define artifacts within a particular folder (and its subfolders) within the repository, but might have no authorization to change anything outside of that, nor to publish any resources he or she creates.