ACLs for a complex and large multi-level organisation

[Upperholme]

Reading the documentation it appears that the existing ACL system could work for much of the requirement for a complex multi-level organisation that I'm working with currently. However I feel that the complexity of the organisation (over 500 local units, and six or seven levels of regional/national organisation, plus a number of cross cutting groups and sections) would quickly lead to an unwieldy situation that would be difficult to manage.

I came across the - unfortunately incomplete - wiki page at http://wiki.civicrm.org/confluence/display/CRMDOC/Multi-level+Organization+ACL+Permissions which describes very closely the sort of scenario that I'm looking to manage, and indicates that there is a solution, but doesn't go as far as providing the detail of that solution. Assuming that I'm not the first (and I've located a couple of fairly old forum threads that evidence that) I'm wondering what the current state of the art is on this issue.

Is there custom code available, or that might be made available that we could maybe tweak to fit our use case? Anyone got a functional extension that might help on this issue? Or any advice about the best practice approach?

Thanks for any feedback.

[jaapjansma]

What I have done recently for an organisation which has members of local branches. And managers of local branches should access those contacts and managers of regions should have access to all contacts which belong to all local branches under the region they are manager of. The same goes for provinces and the managers of the national office.

My solution consisted of the following:
- Contact (types) for local branches, regions, provinces
- Custom field on contacts in which I indicate to which branch, region and province this contact belong (this custom field is populated automaticly from the address but could be overriden manually)
- Custom field set on Individuals determining to which parts they have access. This is a mutiple field with contact references to local branches, regions and provinces. This field determines the access
- Custom code to implement the hook_civicrm_alcWhere based on the custom fields above

Jaap

[petednz]

purely in my efforts to be consistent, since i feel i am seeing parallel discussions in a number of threads - here is another approach (though I don't know how well it scales to Graeme's situation but would be worth ruling in/out

Another approach Fuzion have worked on and 'like' is based around cascading permissioned relationships.

So if Person A is 'officer' for Branch A, then sees contacts with relationship to Branch A

If Person B is 'officer' for Region A, and if Region A has permission over Branches A1, A2, etc, then Person B has access to all contacts at level A

And up it goes ....

[Upperholme]

Thanks guys.

Pete - yours strikes me as a particularly elegant approach. I'll do some work based on that to see where it gets me. What was that other thread you referred to? (might be useful).

[petednz]

1.2 branch from here https://civicrm.org/extensions/relationship-permissions-acls