Thoughts on a module to provide an ergonomic mode permissions system based on roles.

I have been exploring JonBob's excellent modules for providing granular access to nodes, and indeed currently have nodeperm_taxonomy in use at my site. However, it doesn't really provide the correct default behaviour for my users who don't know what they are doing, so last week during a long plane ride, I gave some thought to a slight variation on functionality, and might perhaps try and create a module that performs that way (and from looking, but not yet understanding the code in detail - I suspect this can be done without patching) as a contribution (although I am sure I will have a steep learning curve here). I would welcome comments on the functionality suggested below.

The module - lets call it the "Access" module will provide an administer function. This will be used to set the default access rights to any node based on a users role. It will have one drop down list box per role currently defined, with the following 5 options

No Access
View Node
Comment on Node
Edit Node
Delete Node

These defaults (and any changes - see below) will apply to Non Authors - I assume Authors will always have Delete rights

This is all this administration module will do.

There will also be an entry in the admin/user/configure/permission function which provides two lines to the permissions per role check box list (a check in the box enables this). Those two lines will be

administer default access
change default access on nodes

I am assuming (but I want to check this against other modules) that I can store this configuration information in the "system" table, but if not I will have to create a small special table to hold this data.

For each node, then if the author (or other with Edit permission) is creating or editing a node, then if the role they have has "change default access on node" permission then an additional field will be provide in the node create/edit form. For each role currently defined there will be a drop down list box with the 5 access options items defined above, preselected at the default setting. They can of course be changed during edit.

The result of a create/edit node action will be to add a record per role in the node_access table under the realm "access" with the "grant_x" columns set from that selection (I am assuming here that a "grant_comment" column is there - I think there was a patch to test an apply it recently).

There are several benefits of taking this sort of approach. The first, and most important, is that a standard user does not have to concern himself with access rights if he doesn't want to. Someone else can define the default to be used. The second, is that the real estate on the node form is kept to a minimum (one drop down list per role, if the editor has "change default access" permission). There third is that it uses roles as the driver for access rights, and not some other, not quite compatible concept based on taxonomy or other approach.