php - MYSQL database design to Serialize or not -

we have existing application runs on php , mysql. in process of adding fine grained user authorization, users access resources. there few thousand users , approx 100 resources (although both expected grow).

my db design like:

users: id, name, email

resources: id, resource

option 1 so, if approached typical db normalisation in mind, have following table well. guess follow structure of users being denied permission unless there record in user_resources table. if permission subsequently removed particular resource, delete row user_resources table.

*user_resources:* user_id, resources_id

option 2 alternative forget user_resources table , create new column in users table (called permissions or similar) , store serialized value of users permissions in users table. each time need check user's permission, have unserialize value.

which approach considered better practice, , there major pro's or con's either?

option 1 way go unless have solid arguments against it. adding column users table fine role based permissions. can mix 2 options, if base permissions on roles allow assign different permissions - write in table exceptions.