I know I am probably beating a dead-horse to death, but my company is on the verge of a full DNN 4.8 implementation. Right now we are in the staging / planning phase of the project. We are hammering out how our user structure is going to work, what user groups are going to be / work. How gets admin rights and who doesn't and what rights they get etc. The only catch we have right now is with DNN 5 being so close to its first wave of release. I am aware it will have releases throughout the year and probably deep into next year to complete all their target goals. The reason its a catch for us is a few of the mentioned features are going to completely change how our whole user role / model is setup in regards to access. Work flow is also a huge piece for us and there are other countless pieces of DNN 5.0 the core team has released which really are looking at causing us to do a full redesign a in 8 months from now. A complete list of features regardless of when they would be released, and maybe a rough outline of how they are hoping to implement them would really let my group know where to put in "placeholder" user models / designs and where to really focus cause its remaining the same as it is now for the most part.

Charles Nurse's blogs are completely awesome, but just a brief bulleted list with rough timelines, IE: new admin security break out - should be in with first release or shortly afterwards. New skin parser Q2-Q3. etc etc I have looked around for such a list but have not found one yet, and it shouldn't be a mega super secret for the core team to begin with.

Just am going to really hate having to design for 4.8 and then redesign our whole user model for 5.0 in 8 or so months. Not that I don't love job security :)

I can advise you on that right now: Don't give out DNN Admin rights as part of any content management role's workflow.

Your role and permissions heirarchy should reflect the work processes in the business and should not be influenced by the framework you use. The only case where that rule doesn't hold is the DNN admin role - because it has a range of functionality permanently tied to it. So long as you don't hand that out now, you won't need to withdraw permissions and revise your role structure later.

Use third party modules to provide file and user management facilities to a lesser role instead. It's much easier to swap modules later on than it is to alter your role structure.

Rob