Although I agree with the Ken Down nomenclature, I do not always agree that users and roles are one and the same entity.
Base objects:
Users (user_id, user name, real name, user_status, etc)
Role (role_id, role name, role_password, etc)
Privilege (priv_id, base object, functionality, what have you)
Associative objects:
User has Role (0 - n) (user_id, role_id)
Role has Role (0 - n) (role_id, has_role_id)
User has Privilege (0 - n) (user_id, priv_id)
Role has Privilege (0 - n) (role_id, priv_id)
source
share