Developers should consider using privileges to provide access instead of MarkLogic’s out of the box roles, which may unwittingly expose restricted content to end-users. Samplestack encountered this scenario and illustrates the design pattern to use the rest-reader privilege instead of the rest-reader role for its application-specific security model.
