Store permission facts and inheritance rules, not checkbox paint. Derive each row's checked, unchecked, or mixed presentation from a revisioned permission snapshot, and expose unknown descendant coverage instead of pretending that unloaded children do not exist.
A nested permissions editor looks like a tree of checkboxes. That surface hides two different hierarchies: the resource tree being displayed and the authorization policy that determines effective access. Bugs appear when the UI treats a visual parent checkbox as policy truth, or uses the currently mounted children as if they were the complete subtree.
Separate permission truth from row summaries
Keep resource nodes, child indexes, explicit grants, explicit denials, inheritance rules, and server aggregates in normalized records. Derive visible rows from expansion. Derive each row's checkbox summary from the permission snapshot and its known coverage.
For a complete group, none selected means unchecked, all selected means checked, and a mixture means mixed. Partial loading adds another dimension. A row can have a known checked summary and incomplete coverage. Display both facts. Do not overload one dash glyph to mean mixed values, unknown descendants, a pending save, and a disabled policy.
The public interview prompt
Design a reusable nested checkbox permissions tree for an enterprise administration console. Explain:
- normalized resources, parent-child indexes, stable IDs, and visible-row flattening;
- direct grants, inherited access, explicit denials, effective permissions, and policy precedence;
- checked, unchecked, mixed, unknown, disabled, pending, and error presentations;
- partial child loading, server aggregates, pagination, cache generations, and stale responses;
- parent toggles, propagation scope, descendants created later, idempotency, revisions, and conflicts;
- ARIA tree and checkbox semantics, arrow navigation, Space behavior, labels, and announcements;
- large-tree virtualization, search, reveal, selection summaries, and performance budgets;
- administrator authorization, audit logs, least privilege, rollback, testing, and rollout.
Assume one tenant can have a million resources and a subtree can change while an administrator is editing it. Most sessions expose fewer than 250 visible rows. Children and permission aggregates arrive in pages. These are interview assumptions, not product measurements. A general policy-language authoring environment is outside version one.
What the premium solution covers
The full solution defines permission facts and derived states, honest handling of incomplete coverage, inheritance and denial precedence, propagation contracts, revisioned bulk mutations, focus and expansion behavior, virtualized rendering, server authorization, auditability, conflict recovery, observability, tests, and an interview rubric.
Original media follows a partial subtree through a safe update, separates permission facts from row summaries, maps five presentation states, and opens the bulk-operation envelope. Two deterministic labs expose tri-state and propagation edge cases directly.