The Contributor Role

Initially there are 3 default roles: unauthenticated users, authenticated users, and the admin role. Unauthenticated users can read content and that's about it. Authenticated users can add comments. Admins can do everything.

Like on a UNIX system, I don't work in admin/root if I can help it. I'll temporarily escalate my privileges to perform whatever task is needed, then I get out. This is so I don't accidentally break things in big ways. This is also why you don't bless your own account with super-user privileges.

I wrestle with allowing everyone full-read access to the site. Eventually there will be things on here that I want to have available only to vetted users. Once I start building the restricted content, I'll raise the restrictions I guess. For now, letting everyone have a look-see is for the best.

I created a new role this evening that I called "contributor." This role allows the user to create new article and basic page nodes, and edit their own nodes. There is an order of roles which governs how permissions are inherited. For example, I placed contributor between authenticated user and admin. So I only had to add the additional permissions on the role definition since it inherited the permissions granted by authenticated user. I'm not sure I like that. I am able to make a user a member of multiple roles. I prefer it that way, but perhaps I'm misinterpreting what the admin editor is telling me.

For now, it will work. I see users falling into only a few classes: passers-by that can read all of our public articles, vetted users that can see all of the content and databases, contributors that create new articles, event managers, sub-site admins, and the overall sysadmin role.