Permissions in Web Dynpro Applications

Hi,

I develop an application for booking devices. Devices belong to a department. At the moment I assign 3 (portal-)roles (read, write, administrate) to every department. So, only users with read access (belonging to "read" role) can see the device, and so on.

For administrative users it is possible to create departments. For this reason it is necessary to create new roles in my application and assign roles to department.

Now I have the demand to implement the permissions on device level. I worry that sometimes I have to implement the permissons on booking level. In this case, I have to create 3 roles for every booking.

Could this be a problem for the portal? Is there a better way to do so?

(I thought about UME Permissions, but to my knowledge it is not possible to create actions without deploying)

Any recommendations?

Best regards,

Roman