CiviCRM Community Forums (archive)

Hi - just need to run through this scenario and ensure we pick the best option. Feel this has been asked about several other times but not sure that simple ACL is workable in large systems.

SCENARIO
Organisation has companies as members, and their nominated 'employees' who are added as individuals inherit the membership.

There needs to be a Company Admin who can view/edit contact and custom data for the employees - and add new individuals.

OPTIONS
We could use ACLs but that seems like it would have to create a group for every Company - and that would be less than ideal.

Can we use the ACL hook to restrict people with the relevant permission to just the other employees in the company? And then limit what they can see/do via both Permissions and perhaps some profiles?

Or do we try to extend the 'contact dashboard' so that person with 'rights' allocated via Relationship can access the Custom Data of their 'flock'?

Or do we construct a Profile that is only available based on Permissions as per http://forum.civicrm.org/index.php/topic,6129.0.html (can't quite see how this can then enable the user to edit the contact without ending up with more permissions so probably not the route for this one)

ps - in testing a Permission based route, I was surprised to find that Manage Groups and Activity was available to someone with the following permissions

thanks lobo - i think that was the answer i was hoping for - will get on to it and provide some documentation as this seems like the sort of access controls that have often been asked for

and yes that last sentence should have been deleted but i obviously got distracted and hit 'post' - though my surpise was that someone who is locked down on every other level via permissions still has total control over Groups.