title: Resource Based Access Control vs Role Based Access Control
body: <p>I am learning Apache Shiro, and I found this article:</p>
  
  <p><a href="http://www.stormpath.com/blog/new-rbac-resource-based-access-control" rel="noreferrer">The New RBAC: Resource-Based Access Control</a></p>
  
  <p>And the author said:</p>
  
  <blockquote>
    <p>.......you could assign behaviors (permissions) directly to a Role if you
    want.  In this sense, you would still have a Role-Based Access Control
    security policy - it is just you would have an explicit RBAC policy
    instead of the traditional implicit strategy.</p>
    
    <p>But that begs the question - why stop at roles?  You can assign
    behaviors directly to users, or to groups, or to anything else your
    security policy might allow.</p>
  </blockquote>
  
  <p>It seems that the author prefer to store the relationship of User and Permission directly instead of through a Role.</p>
  
  <p>Though it seems this is simple and straightforward, I have some questions:</p>
  
  <ol>
  <li><p>Are there any essential differences between two of them?</p></li>
  <li><p>The Database schema.</p></li>
  </ol>
  
  <p>In a Role Based Access Control, normally we use three tables to describe the relationship:</p>
  
  <pre><code>user
  role
  user_role
  </code></pre>
  
  <p>No if I use the Resource Based Access Control, what is the normal practice for building the tables? </p>