title: Role based access control - correct MVC pattern
body: <p>I started using the MVC pattern a half year ago, and I still have some misunderstandings.</p>
  
  <p>Now I want to implement a role based access control in my application. However, my question is not about RBAC, it is about MVC.</p>
  
  <p><strong>My implementation of RBAC is this:</strong>
  <em>user->role->permission</em>
  so every user (ex. userA) can have many roles (ex. reader, editor, admin), and every role can have many permissions (read, update, delete, etc.).</p>
  
  <p><strong>MySQL tables</strong></p>
  
  <ul>
  <li>users (list of users)</li>
  <li>roles (list of roles)</li>
  <li>permissions (list of permission)</li>
  <li>roles_permissions (list of roles->permissions connections. ex. editor->update)</li>
  <li>users_roles (list of users->roles connections. ex. userA->editor)</li>
  </ul>
  
  <p><strong>Now my question is</strong>
  How should I implement this in MVC?
  Have a separate model for: users, roles, permissions, roles_permissions, users_roles, than have an authManager class that creates users, roles, permission, roles_permissions, and user_roles? 
  Is this way correct? Is there a better, maybe more elegant way?</p>