Permission tiers are the simplest of methods for performing access control.  Users are given numbers in a heirarchy, with lower numbers having more privileges than user who are assigned a high number.  For example consider the following user permission heirarchy:

User Classes

User Class Name	Class Number
SuperAdmin/Developer	0
Administrator	1
Manager	2
Editor/Staff	3
Privileged Visitor (member)	4
Ordinary Visitor (not logged in)	5

As you can see, a lord-high Administrator has a class number of one, while the peasant editor has a three.  The unwashed masses that simply visit the site get a five (a number that should be assigned by default in /Application.cfm).

This becomes meaningful when you consider the following code snippet, which assumes that the user Class Number in the table above is kept in the variable User.ClassNumber:

<cfif User.ClassNumber gt 3>
     <p>Access Denied!</p>
<cfelse>
     <!---
     ... do privileged stuff here ...
     --->
</cfif>

This bit of code looks to see if a user's privilege level is at least three.  If it is, the user gets in.  That means that a bit of code or a page that is protected by this sort of tiered access would allow in an editor, but also would allow in a manager as well as an administrator.  This makes sense as 'higher' classes of user tend to have more privileges: Whatever you can see your bosses can see as well.

You could also use 'tiered' access as a very simple form of departmental control.  Consider this similar table:

Departments

User Class Name	Class Number
Sales	1
Marketing	2
Shipping	3
Public Affairs	4
Human Resources	5

These user classes are simply different.  They do not necessarily indicate one has authority over another.  For a situation like this a relevant code snippet would be:

<cfif Compare(User.ClassNumber,"3")>
     <p>Access Denied!</p>
<cfelse>
     <!---
     ... do privileged stuff here ...
     --->
</cfif>

The code above would restrict access exclusively to the Shipping Department.

To sum up, tiered access is perhaps the most common form used when only simple password protection is necessary.  Think of it as a blunt instrument that is effective so long as you don't need to get fancy.  If your needs get more complex there's not much more you can do with tiers than what you see here.  Thats where roles and groups come in so very handy.

Examples of how to work tiers into your code using AccessMonger Pro are available to registered users.