CiviCRM Community Forums (archive)

Hello,

We need to set up user permissions to restrict access to sensitive data e.g. young people or celebrities

We've done this on a test server by:

1. removing permissions to view/edit all contacts within Drupal Access Controls
2. creating a smart group for all contacts not in "Young people" or "Celebrity" groups
3. giving the basic CRM user ACL group permissions to edit all contacts within this smart group

This all works fine. However, the consequence of using this set up would be that basic CRM users (most staff) can not use any other groups. This is quite a big problem as groups are the main way we organise contact data and it also stops staff using CiviMail and searching on groups.

Giving permission to view additional groups would seem to undermine the whole purpose of restricting access because if, for instance, a contact in the restricted "Young People's" group was also in the a "Monthly enews" groups then any contact with permission to view Monthly enews would have access to this contact too.

My question is: can you restrict access to a set of contacts without blocking access to all groups?

Thanks,

Ed

If I can restate this question - it sounds like there's a desire to have a "Deny access" ACL.  The short answer is no - CiviCRM doesn't currently support denying access via ACLs, just granting them.

If this is an important feature for you all, you may want to consider sponsoring its development.