The five base tables represent the basic data model of the system, with a set of views provided to convert them into a format suitable for joining to answer specific questions. The exact means by which this transformation takes place should not be depended on, since they may change for efficiency reasons. This refers to actions that happen mainly at package installation time - a package will create a number of methods for its own use, then associate them with the system's standard privileges, or new privileges which the package has created. The association step might also happen later, if the site-wide administrator chooses to change permissions policy. A web page for manipulating these features should be limited to site-wide administrators.
Users are typically able to administer permissions for objects they themselves create.
Finally, when administering the permissions for an object, a web page needs to know all permissions directly granted on that object. At installation time, a package will add to these three tables to introduce new permissions into the system. If the permission is already in the system, no change occurs. One returns true or false, the other presents an error page. All users of the permissions system are the same at the user-interface level.