Re: [security-dev] how to model services managed by a realm

The main idea behind tiers are to share role/groups between realms. And not tie them to a specific realm. From the documentation: "A Tier is a more restrictive type of partition than a realm, as it only allows groups and roles to be defined (but not users). A Tier may be used to define a set of application-specific groups and roles, which may then be assigned to groups within the same Tier, or to users and groups within a separate Realm." I think I have discussed that with Shane some time ago about attributes on partitions. Need to recall that. But I agree that partition-scoped attributes can be handy.