Chapter 6 — Discrete structures

Chapter 6 — Discrete structures

Lesson map

Lesson 06 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Sets of accounts"]
  N2["6.2 Groups and permissions"]
  N3["6.3 Relations as tables"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Sets of accounts"]
  N2["6.2 Groups and permissions"]
  N3["6.3 Relations as tables"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX016"]

[Learning outcomes]
    |
    v
[6.1 Sets of accounts]
    |
    v
[6.2 Groups and permissions]
    |
    v
[6.3 Relations as tables]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) describe users, groups and permissions as sets; (2) use set operations to compare lists; (3) draw relations as tables.

6.1 Sets of accounts

A set is a collection of distinct items. Greenhill's current staff from HR form one set; enabled accounts in the office suite form another. Comparing the two sets answers practical questions. Accounts in the second set but not the first belong to nobody currently employed, which may mean leavers. Staff in the first set but not the second may be new starters waiting for an account. Elena uses set difference, a basic operation, to turn a vague worry about leftover accounts into a precise list to check.

6.2 Groups and permissions

Access is often given through groups: everyone in the housing-officers group can open tenant records. Each group is a set of users, and each permission is linked to groups. A person's access is the union of the permissions of all their groups. When someone is in several groups, their combined access can be more than anyone intended. Elena writes groups and their permissions as a simple table, then computes each person's combined access so it can be compared with what their job requires.

6.3 Relations as tables

A relation connects items from two sets, such as which users belong to which groups. Writing it as a table, with users as rows and groups as columns and a mark where a user belongs, makes patterns easy to see. A row with many marks may be a person who has collected access over years. A column with very few marks may be a group nobody uses. Elena finds such tables easier to discuss with managers than lists, because managers can quickly spot what looks wrong for their team.

Worked example

In a January export, set difference between 140 synthetic HR staff and 147 enabled accounts finds seven accounts with no current employee and none missing.

Synthetic case. Staff, accounts and groups are synthetic.

Errors and limits

Reviewing group names without computing each person's combined access misses access gathered through several groups.

Exercises

• EX016 — Leftover accounts. Which set operation finds accounts with no current employee? Rubric: 3 = enabled accounts minus HR staff;; 2 = difference;; 1 = union;; 0 = none.
• EX017 — Combined access. How is a person's access computed from groups? Rubric: 3 = union of their groups' permissions;; 2 = union;; 1 = intersection;; 0 = none.
• EX018 — Leftover count. How many accounts with no current employee does the worked example find? Rubric: 3 = seven;; 2 = 7;; 1 = vague;; 0 = none.

Synthesis

Sets, unions and relation tables turn account and group lists into clear questions about access.

Continue studying — chapter 06 of 40

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →