anchor.diff:  -type ddPermission() :: atom() | tuple().   %% e.g. manage_accounts, {table,ddDash,select}
   -type ddQuota()      :: {atom(),any()}.     %% e.g. {max_memory, 1000000000}
   
  --record(ddAccount,                          %% imem cluster account (shared by application)
  +%% imem cluster account (shared by application)
  +-record(ddAccount,
                     { id                      ::ddEntityId()
                     , name                    ::ddIdentity()        %% unique login id (mutable)
                     , type='user'             ::atom()              %% user | driver | deamon | application
  
positive.code: -include_lib("imem/include/imem_exports.hrl").
  
  -define(DEFAULT_ROW_SIZE, 100).
  -record(viewstate, { table_layout = []
                     , column_layout = []
         }).
  
  -record(ddAdapter,                          %% DDerl adapter (connect to databases)              
                    { id                      :: atom()             %% oci | imem | ets | os_text | dfs_text | hdfs_text
                    , fullName                :: binary()           %% displayed in drop down box
                    }
         ). 
  -define(ddAdapter, [atom, binstr]).
  
  -record(ddInterface,                        %% DDerl client interface (connect to ui / applications)               
                    { id                      :: atom()             %% ddjson
                    , fullName                :: binary()           %% displayed in drop down box
                    }
         ).
  -define(ddInterface, [atom, binstr]).
  
  -record(ddConn,                             %% DB connection    
                    { id                      ::ddEntityId()       
                    , name                    ::binary()          %% connection name (mutable)
                    , owner                   ::ddEntityId()      %% account.id of creator / owner
                    , adapter                 ::atom()            %% oci | imem | ets | os_text | dfs_text | hdfs_text
                    , access                  ::any()             %% erlang term depending on adapter (e.g. ip+service or tns)
                    , schm                    ::any()             %% erlang term depending on adapter (e.g. name or uri or data root path)
                    }
         ).
  -define(ddConn, [integer, binstr, userid, atom, term, term]).
        
  -record(ddCmd,                              %% DB command     
                    { id                      ::ddEntityId()       
                    , name                    ::binary()          %% command template name (mutable)
                    , owner                   ::ddEntityId()      %% account.id of creator / owner
  
negative.code:                   , lastFailureTime         ::ddDatetime()        %% erlang time of last login failure (for existing account name)
                    , lastPasswordChangeTime  ::ddDatetime()        %% change time (undefined or too old  => must change it now and reconnect)
                    , locked='false'          ::'true' | 'false'
                    }).
  
  -define(ddAccount, [userid,binstr,atom,list,binstr,datetime,datetime,datetime,boolean]).
  
  %% hierarchy of roles with permissions and access privileges to connections and commands
  -record(ddRole,
                    { id                      ::ddEntityId()            %% lookup starts with ddAccount.id, other roles are atoms
                    , roles=[]                ::[atom()]                %% granted roles
                    , permissions=[]          ::[ddPermission()]        %% granted permissions
                    , quotas=[]               ::[ddQuota()]             %% granted quotas
                    }).
  
  -define(ddRole, [userid,list,list,list]).
  
  