what design pattern is good for this scenario ?

Wants to design a GUI that shows students' grades. When a student logs in, he can see his grades but can't change; an instructor logs in he can see and enter/modify grades; when an administrative staff loggs, he can see and delete student grades after the student leaves school but he can't modify or enter grades.

what design pattern is for such thing ?

I don't think you need a specific design pattern for this situation.

Its all about RBAC (Role Based Access Control), which you can handle it programatically by checking the user's status/permissions and decide on the action.

One common model is a user has 0..n roles. Each role has 0..n permissions. Make a permission for anything one user can do and another cannot. The existence of a permission, say "Modify Grades", in the user's tree means he can do that.

A more complex model has an access control object instead of permission. It might Grant or Deny rights to Create, Read, Update, Delete, Execute etc on every restricted thing. Some systems take the "most restrictive" result, so if a user has Grant Modify Grades in one role and Deny Modify Grades in another, the Deny wins.

Any of that sound right for your requirements?

Originally posted by Stan James:
One common model is a user has 0..n roles. Each role has 0..n permissions. Make a permission for anything one user can do and another cannot. The existence of a permission, say "Modify Grades", in the user's tree means he can do that.

A more complex model has an access control object instead of permission. It might Grant or Deny rights to Create, Read, Update, Delete, Execute etc on every restricted thing. Some systems take the "most restrictive" result, so if a user has Grant Modify Grades in one role and Deny Modify Grades in another, the Deny wins.

Any of that sound right for your requirements?

I like the idea of "Access control object", could you talk more and give an example to explian it ?