Setting different context access levels in the manager for the same user

When it comes to ACLs there's a few major things to keep in mind.

1) there's an "allow/deny" kind of way. Everyone has access, untill one entity (user group) is given specific access at which point the rest is locked out until they get specific access as well.
2) we need something as differentiator to assign our ACLs to.
3) it's scary and all that, but don't overcomplicate.

In this situation, Aaron wants to achieve a way to basically lock out managers from making any changes to a certain context.

I'm not sure where resource groups came in to play here, cause we already have our differentiator: the context! Then we just need to figure out how to lock them out from doing anything with the context other than reading (aka list, load and view).


After working with Aaron directly, this is the strategy we came to if you want to show contexts, but not make them editable:
- Make sure there's a user group that has full access to everything without the sudo box. Administrator usergroup with admin ACLs for each contexts or so.
- make sure the Content Editor ACLs (or whatever you have assigned to give usergroups "mgr" permissions) does *not* include edit_document and related permissions. That makes sure they don't get a free pass to edit everything they want in the mgr.
- then add an "Admin Read Only" ACL based on the administrator template which contains the list, load, view, view_context, view_document permissions. We've got a few other permissions in the ACL set here, but I think these are the only ones you really need. Assign this ACL to your "read only" contexts with the right role for your users.
- then add an "Admin Read & Edit" ACL based on the administrator template which contains all permissions related to what you want the user to be able to do.. edit_document and save, save_document are probably the main ones along with what you specified in Admin Read Only. Assign this to contexts you want the admin to be able of fully editing. [ed. note: markh last edited this post 14 years ago.]

That's interesting.
Does it work as expected?