When developing domain models, I can see two major ways of thinking about the user:
The first one assumes that a program is a kind of "simulation" of what happens in the real world, and the user is an spectator. With that approach you would have a Customer class -for example- with perhaps methods that correspond to the actions a Customer can perform. Whenever the customer wants to do something, the corresponding method is called.
The other approach would be to design the classes as if they were exposed to the user and s/he then has the ability to create and play with the objects “directly”, thinking of the program as a kind of extension of the user’s reality. With this approach, a Customer class would probably make no sense as the customer is already “involved”.
I've read some articles talking about adding security at the method level, which seems to be consistent with the second approach, but I believe the first approach is far more popular.
What's the best way to deal with this?