# Representing multiple users with permissions, groups, and boolean flags.

**URL:** <https://forum.djangoproject.com/t/representing-multiple-users-with-permissions-groups-and-boolean-flags/2992>\
**Category:** Using Django\
**Created:** [June 15, 2020, 7:31pm UTC](https://forum.djangoproject.com/t/representing-multiple-users-with-permissions-groups-and-boolean-flags/2992 "2020-06-15T19:31:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![darockstop](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/darockstop/32/1290_2.png) [@darockstop](https://forum.djangoproject.com/u/darockstop)\
**Post date:** [June 15, 2020, 7:31pm UTC](https://forum.djangoproject.com/t/representing-multiple-users-with-permissions-groups-and-boolean-flags/2992/1 "2020-06-15T19:31:07Z")

</div>

Hi,

Context: For my first django site I am planning out my models and how I will represent the difference between a parent user and a kid user (basically–parents can add/manage children, children cannot). After doing some research, it seems that the best option will be to give parents custom permissions through a parent Group since the differences are small. (If you disagree, I would love to here what ideas you have.)

The default user model from contrib.auth has the flags is\_staff and is\_superuser. I am wondering, why have these separate flags when you could add the user to a group and check for permissions that way? My guess is that these flags must serve some purpose I am unaware of, or maybe they are redundant but there is something useful about it?

The reason I ask is that I am wondering whether I should add an is\_parent and is\_child flag to my user model. Alternatively, the way I understand them–I think I can use just groups. In fact, if the differences between parents and children are small, I suppose I could forget groups altogether (still figuring out how I am supposed to create these at deployment without using the admin page) and just add two or three custom permissions to a parent when I create them. Or what if there is just one custom permission called parent? (that’s a bad idea, right?)

I think my generic question can be boiled down to: when and why do you use Groups? when and why do you use boolean flags?

Thanks

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [June 15, 2020, 9:51pm UTC](https://forum.djangoproject.com/t/representing-multiple-users-with-permissions-groups-and-boolean-flags/2992/2 "2020-06-15T21:51:10Z")

</div>

Couple different questions here - trying to split it out a little.

- is\_staff allows the user to use the admin facility
- is\_superuser is supposed to allow all privileges (has\_perm is supposed to return true in all circumstances). (However, it is possible to create a situation where that doesn’t occur, leading to all sorts of interesting issues.)
- Groups are useful for assigning multiple permissions to multiple people. For example, a group may be assigned a list of permissions such as ‘app1.add\_model1’, ‘app1.change\_model2’, ‘app2.view\_model3’) This lets you “group” sets of permissions together such that people assigned to that group have all those assigned permissions.
- Permissions in Django is generally intended to be rather discrete, which is why you’ll see so many permissions having been created of the form ‘app\_name.add\_model\_name’, ‘app\_name.view\_model\_name’, ‘app\_name.change\_model\_name’, and ‘app\_name.delete\_model\_name’, rather than at a higher level such as a generic “parent” permission. Rather, you would want to create a group named Parent which has the individual permissions assigned to it.
- We use boolean flags in our custom User object for a very small number of very specialized permissions that reside “outside” the typical model-access permission. (For example, we would use a boolean flag if we needed to grant an individual the right to put a site into maintenance mode but not have any other administrative authority.)

Ken