I have implemented RBAC (Role Based Access Control) tables. I have a requirement to add extra attribute on some roles, like 2nd_pwd attribute in Admin role, address attribute in Customer role.

I have done this design, but it violates data integrity. When you removed (let's say) Admin role, you also need to remove admin data from Admin table. So I decided to add trigger for this job.


  1. Is there a design for this requirement without trigger but still doesn't violate data integrity?
  2. What is the common implementation for this requirement? Is it normalized enough?

enter image description here]1

Thank you.

  • What about some nullable columns for those attributes in the Group table? Or a JSON column to have variable attributes? – joanolo Jun 18 '17 at 19:40
  • 1
    @joanolo How about normalized table with less nullable attribute? – Yosua Lijanto Binar Jun 19 '17 at 5:15
  • IMHO: An unnecessary complication. – joanolo Jun 19 '17 at 6:41
  • 1
    @joanolo yeah it's complicated, but It's more complicated if I have 10 groups, and each group has 10 additional attributes, and all is stored in Group table. – Yosua Lijanto Binar Jun 19 '17 at 7:45
  • updated the description. – Yosua Lijanto Binar Jun 20 '17 at 5:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.