Adding a new ACL entry
========

Adding a new ACL consists of 4 parts:

#### Resources
 
These are the large modules of the system usually.  In the Orchard's case the OrchAuth ZF controller plugin uses the controller name as the resource name.

#### Privileges
 
This is the actions that can be performed against a resource.  The OrchAuth plugin uses the request's "action" as the privilege name.

#### Permissions

These is a representation of a type of permission against a privilege.  Think "allowed", "not allowed", "approval needed" "report attempts".  In the Orchard's ACL every record in the permissions table is essentially "allowed" - we don't use any other types of permissions.

#### Role Permissions

This it the assignment of a permission to a particular role.  If there is a resource named "Releases", and a privilege named "delete", and a permission called "allowed", the final combination might be ```"Client Managers" are "allowed" to "delete" a "releases".```

### Creating a new ACL entry

In order to properly construct a liquibase changeset for creating a new ACL entry, you should include logic to 

* Create the resource if it doesn't exist
* Create the privilege if it doesn't exist
* Create the permission if it doesn't exist
* Assign the new permission to the Tech Manager role

The changeset should also include logic to delete ONLY the rows that were just added (by name, not by id).

You can also the [Convenient ACL Creation Template](liquibase-acl-template.xml).