Body: <p>We want to create a role for a certain set of users in WP/Civi - to have access to only a certain group of contacts.</p>
  <p>Here's what we have done.</p>
  <ul>
  <li>Added the Members plugin to create new roles</li>
  <li>Assigned that role to a WP user</li>
  <li>In the Group of contacts settings -enabled Access Control (under Group Type)</li>
  <li>Under Access Control &gt; WordPress Access Control - disabled all the areas this user should not have access to when they log in</li>
  <li>Under Access Control &gt; 1. Manage Roles &gt; Created a Role under</li>
  <li>Under Access Control &gt; 2. Assign Users to CiviCRM ACL Roles &gt; Assigned the Role created in the previous step and assigned it to the group with the Access Control to that group (options is anabled)</li>
  <li>Under Access Control &gt; 3. Manage ACLs &gt;
  <ul>
  <li>Added an ACL</li>
  <li>Added description</li>
  <li>Added the Role</li>
  <li>Gave Operation of View</li>
  <li>Type of Data = A group of contacts</li>
  <li>Group = the group with the Access Control enabled</li>
  </ul>
  </li>
  </ul>
  <p>If I log in as that person, all the features are missing that I disabled under WordPress Access Control, so that is working.
  However, the person can still access all the of contacts they should not have access to.</p>
  <p>We have followed all the instructions here <a href="https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/" rel="nofollow noreferrer">https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/</a> and followed this video <a href="https://youtu.be/_fIw1ovN_-I" rel="nofollow noreferrer">https://youtu.be/_fIw1ovN_-I</a> but somewhere this a step missing that we are clearly overlooking.</p>
  <p>Any thoughts would be appreciated.</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-09-07T16:13:00.540Z
Comments.Text: Have you removed the 'View all Contacts', 'Edit all Contacts' permissions at this stage: https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/#access-control-permissions-in-wordpress
Comments.UserDisplayName: Aidan
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-09-08T07:38:36.100Z
Comments.Text: Thank you @Aidan, a little closer now. When I log into the person's profile now, they can only see their own account
Comments.UserDisplayName: Grow
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-09-08T09:32:08.917Z
Comments.Text: It might be easier if you describe what you want to achieve.  From your phrase 'the group with the Access Control enabled' - I wonder whether your understanding is not quite correct.  That setting means the group can be used in an ACL to grant members of that group additional access beyond what they have from the CMS permissions.  There are 2 groups involved: Group A (step 2) is given a role that has access to the records of Group B (step 3).
Comments.UserDisplayName: Aidan
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-09-08T10:01:15.383Z
Comments.Text: Thanks @Aidan I have updated the description above with what we are trying to do. i.e. give someone a role and only allow them access to a certain group of contacts. Will check the rest of your comment in a moment
Comments.UserDisplayName: Grow
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-09-14T06:52:23.270Z
Comments.Text: Hi @Aidan - wondered if you had managed to see the above description change? Thanks
Comments.UserDisplayName: Grow
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-10-26T18:11:34.327Z
Comments.Text: Hi @Aidan - we've not yet managed to figure this one out, if you wouldn't mind shedding some light on it please?
Comments.UserDisplayName: Grow
Tags: <acl><roles>
Title: Restricting contacts in groups using ACL roles
ThreadText: # Restricting contacts in groups using ACL roles
  
  (Asked by: username_0 on 2021-09-07)
  
  We want to create a role for a certain set of users in WP/Civi - to have access to only a certain group of contacts.
  
  Here's what we have done.
  
  * Added the Members plugin to create new roles
  * Assigned that role to a WP user
  * In the Group of contacts settings -enabled Access Control (under Group Type)
  * Under Access Control > WordPress Access Control - disabled all the areas this user should not have access to when they log in
  * Under Access Control > 1. Manage Roles > Created a Role under
  * Under Access Control > 2. Assign Users to CiviCRM ACL Roles > Assigned the Role created in the previous step and assigned it to the group with the Access Control to that group (options is anabled)
  * Under Access Control > 3. Manage ACLs >
    + Added an ACL
    + Added description
    + Added the Role
    + Gave Operation of View
    + Type of Data = A group of contacts
    + Group = the group with the Access Control enabled
  
  If I log in as that person, all the features are missing that I disabled under WordPress Access Control, so that is working.
  However, the person can still access all the of contacts they should not have access to.
  
  We have followed all the instructions here <https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/> and followed this video <https://youtu.be/_fIw1ovN_-I> but somewhere this a step missing that we are clearly overlooking.
  
  Any thoughts would be appreciated.
  
  **Tags:** acl, roles
  
  > **Comments:**
  > **username_1**: Have you removed the 'View all Contacts', 'Edit all Contacts' permissions at this stage: https://docs.civicrm.org/user/en/latest/initial-set-up/permissions-and-access-control/#access-control-permissions-in-wordpress  
  > **username_0**: Thank you @username_1, a little closer now. When I log into the person's profile now, they can only see their own account  
  > **username_1**: It might be easier if you describe what you want to achieve.  From your phrase 'the group with the Access Control enabled' - I wonder whether your understanding is not quite correct.  That setting means the group can be used in an ACL to grant members of that group additional access beyond what they have from the CMS permissions.  There are 2 groups involved: Group A (step 2) is given a role that has access to the records of Group B (step 3).  
  > **username_0**: Thanks @username_1 I have updated the description above with what we are trying to do. i.e. give someone a role and only allow them access to a certain group of contacts. Will check the rest of your comment in a moment  
  > **username_0**: Hi @username_1 - wondered if you had managed to see the above description change? Thanks  
  > **username_0**: Hi @username_1 - we've not yet managed to figure this one out, if you wouldn't mind shedding some light on it please?  
  
  ---
  
  ## 0 answers
  
  