2.9 KiB
2.9 KiB
CRUD Matrices
A CRUD matrix defines what actions a user (or process) is allowed to perform on a certain object, typically a data entity such as a table or record in a database.
CRUD is an acronym for:
- Create - to create and store new data
- Read - to retrieve and read data
- Update - to change or modify then store the data.
- Delete - to delete or remove the data
It is very valuable to combine a CRUD Matrix with the analysis of user processes within the system, especially in the context of the actors and roles involved to complete the picture. (source)
This is a simple form, showing what access or usage an organizational role has with a particular object:
| Create | Read | Update | Delete | Execute | |
|---|---|---|---|---|---|
| Manager | X | X | |||
| Author | X | X | X | X | |
| Editor | X | X | |||
| Publisher | X | X | X | ||
| (Note that "crude" appears, which is create; read; update; delete; and execute.) |
In the form below, we can see which authorizations each role has for different objects:
| Order | Invoice | Customer | Employee | Product | |
|---|---|---|---|---|---|
| Sales VP | CRUD | CRUD | CRUD | CRUD | CRUD |
| Sales Manager | CRUDE | CRUD | RU | R | R |
| Sales Rep | CRUD | R | RU | R | R |
| Stock Manager | - | - | - | R | RU |
A CRUD matrix is a helpful tool for Access Control Models, and several well-known CRUD extensions have been introduced to address specific needs, for example: (source)
- CRUDL (Create, Read, Update, Delete, List): Adds a "List" operation to explicitly support retrieving collections of records, which is especially useful in applications where listing and searching are distinct from simple reading of single records.
- BREAD (Browse, Read, Edit, Add, Delete): "Browse" and "Add" are used instead of "Read" and "Create," and "Edit" instead of "Update," reflecting terminology that is sometimes more intuitive for end-users or specific application domains.
- ABCD (Add, Browse, Change, Delete): Similar to BREAD, this variant emphasizes "Browse" as a separate operation, and "Change" replaces "Update".
- DAVE (Delete, Add, View, Edit): Reorders and renames the operations for clarity or branding in certain software contexts.
- CRAP (Create, Replicate, Append, Process): Introduces "Replicate," "Append," and "Process" for systems needing more specialized data manipulation actions.