I have been going through various permissions available in SharePoint and I can find two ways to set permissions — Permission Levels and Permission Policy.
I am able to assign users Permission Level by going to Site Permissions. But I can't find anything related to Permission Policy. I know I can create Permission Policy Level in Central Administration for a Web Application but how do I use it?
What is Permission Policy used for and how is it different from Permission Level?
Permission Level is the different permissions you can add to a SharePoint Group such as read, edit or full control permission level. Typically all authenticated users have read permission level on a SharePoint Intranet Site, and content authors have edit permission level to enable them to create content. Site Owners, those who administer the site, typically have full control of the site.
Permission Policy is a way to let a group of users (or individual users) access a part of site setting without having full control permission level in all site settings. If you have a group of auditors who need to access Web Analytics data in site settings, but nothing else that the owners group have access to, you create a Permission policy to web analytics data. After the Permission Policy is created you add users or groups in the User Policy setting (and test that it actually works).
In short, Permission level is what level of access is granted to a group, and Permission policy is a way to delegate site administration activities to a group or individual users.
Reference:
User Permission are categorized as list permissions, site permissions, and personal permissions, depending on the objects to which they can be applied, for example, site permissions apply to a particular site, a collection of permissions make a permission level that allow users to perform a set of related tasks, for more information, please refer to: User permission and permission level (SharePoint 2010)
A Web application can contains as many as 500,000 site collections, manage permissions for so many site collections can be complicate and error-prone, permission policies provide a centralized way to configure and manage a set of permissions that apply to only a subset of users and groups in a web application. The difference between specify user permissions for a web application and creating a permission policy for a web application are user and groups to which the permissions apply and the scope at which the permissions apply, for more information, please refer to: Manage permission policies for a web application (SharePoint Server 2010)
User policy is basically an AD user or AD group mapping to certain Web Application Level Permission policy, there is a good article here about how to apply user permissions, permission policy, and user policy, you can refer to it for more information: http://www.sharepointblues.com/2010/09/01/sharepoint-security-and-permission-system-overview/
