What do we want from this application?
The application must allow user accounts to be created and maintained .
It must support the creation of roles and the assignment or removal of privileges to these roles.
It must allow multiple roles to be assigned to a user.
When a role is assigned, the application must allow the security user to designate if that role is to be a default role.
In the process of assigning the role, the previously assigned roles must be preserved, and those that are default roles must remain in that state.
In addition to creating the users, roles, and assignments, the application must allow you to review these assignments.