Yes, I've used "rostering". However, I'm in a unique position in that
I am an Oracle DBA, so I can interrogate the Oracle DB and determine
what roles the user is assigned to determine their authorizations dynamically.
Meaning that once the user is set up by the Security Admin people, they
AUTOMATICALLY are authorized to execute my application.
I don't have to maintain a separate worksheet with the list of authorized users.
Mainly because in my case, trying to keep 180 names up-to-date in each of
10 (or so) applications would be a maintenance nightmare!