One could then perhaps manually edit the list only for adhoc events, like to further allow (or deny) temporary access during application roll-outs.

But, to reduce the number of extra packages the sample application requires, I roll my own MVC pattern, shown in Listing 7.

For application updates, however, you want to roll out your changes at once, and you want control over the timing.