[Question]How can I manage roles from resource instance perspective?

[seanhuang514]

Hi, I'm trying to create a multi-tenant app
here are my relationships of models

1. User can have multiple tenants.
2. Tenants can have multiple users.
3. Tenants can have multiple documents.

class Tenant
  has_many :members
  has_many :users, through: :members
  has_many :document
end

class User
  has_many :members
  has_many :tenants, through: :members
end

class Document
  belongs_to :tenant
end

and I want to add some roles to manage tenants and documents
according to documentation, I should implement like below

# add role to manage tenant
user.add_role(:admin, Tenant.find(1))
user.add_role(:member, Tenant.find(2))

# add role to manage document
user.add_role(:edit, Document.find(1))
user.add_role(:view_only, Document.find(2))

but I'm wondering can I separate roles table by different resources
something like this

class Tenant
 rolify :role_cname => 'TenantRole'
end

class Document
 rolify :role_cname => 'DocumentRole'
end

tenant = Tenant.find(1)
tenant.add_role(:admin, User.find(1))
tenant.add_role(:admin, User.find(2))

document = Document.find(1)
document.add_role(:editor, User.find(1))
document.add_role(:view_only, User.find(2))

the reason that I want to do this way it's because
I'm assuming users might have many tenants and also belongs to different tenants,
at the same time, users might have different roles for each document in tenants
if I always add roles from the user perspective, I'm worried about do I adding too much data to a table (Role table) and it might cause
performance issue when I do queries, another reason is I think separate role table by resources is easier to manage role for resources

do you have any advice for this case? thanks