The figure in the doc is not a class diagram, right? it is more about work-flow which can be implemented in different ways. I propose to store the list application's permissions (the permissions that belong to the concrete application) in the application db same way as the rest of persistent application properties. wdyt?