Developers ask me very often how they can change MCMS user role security rights using the MCMS Publishing API. The reality is that the publishing API does not allow you to change user rights. Depending on the business requirements, one approach is to take advantage of Active Directory groups. Therefore, by adding a user in a particular AD group or changing a user from one group to another, you can change user rights.

Of course, this doesn't work for every single requirement, but for most requirements, where your combinations are sparse, it proves to be effective and a more secure way of accomplishing the desired result.