# How to set up tiered access privileges?

**URL:** <https://www.ruby-forum.com/t/how-to-set-up-tiered-access-privileges/151924>\
**Category:** Rails\
**Created:** [October 28, 2008, 12:52am UTC](https://www.ruby-forum.com/t/how-to-set-up-tiered-access-privileges/151924 "2008-10-28T00:52:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![gaveeno](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/58956e/32.png) [@gaveeno](https://www.ruby-forum.com/u/gaveeno)\
**Post date:** [October 28, 2008, 12:52am UTC](https://www.ruby-forum.com/t/how-to-set-up-tiered-access-privileges/151924/1 "2008-10-28T00:52:38Z")

</div>

I’m using restful\_authentication and role\_requirement to handle use  
authentication for my application. I’m wondering what the best way is  
for me to set up tiered access privileges. Essentially, I want to  
restrict access as follows:

- some users will get access to one or more branches
- some users will get access to one or more regions, including the  
branches within that region
- some users will get access to an entire company, including the  
regions and branches within that company

When a person logs into the application, I want to show them data only  
relevant to their particular branch if they only have access at the  
branch level. Similarly, when a person logs in that has access to an  
entire company, I want to be able to show them company data, regional  
data, and branch-level data.

Should I set up three separate index tables (users\_branches,  
users\_regions, users\_companies), and then when the user logs in just  
do three separate finds, one against each of these three tables, to  
find out their access rights? Or is there a better way to do this to  
cut down on the number of queries?

I hope I’ve been clear enough - let me know if I need to elaborate  
more.

Thanks in advance!