Answers.Body: <p>You might be right. The dashboard as far as I can remember has never used ACL's it just uses "my" or "all". The feature where ACL support for case was introduced might have been for a different need and doesn't seem to have included the dashboard (<a href="https://issues.civicrm.org/jira/browse/CRM-17645" rel="nofollow noreferrer">https://issues.civicrm.org/jira/browse/CRM-17645</a>).</p>
  
  <p>So yes and no to your question?</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2019-10-22T04:23:42.950Z
Answers.LastActivityDate: 2019-10-22T04:23:42.950Z
Answers.UserDisplayName: Demerit
Body: <p>I have a use case where 'volunteers' deal with casework on an area basis, with a 'supervisor' for each area.  Volunteers can add contacts, and view their own cases. Supervisors can view all cases.</p>
  
  <p>Both roles' access to their area's contacts is limited by Civi's own ACL through each service user being assigned to an area group.</p>
  
  <p>This works up to a point, in that neither group has permission to view cases outside their area, but supervisors' dashboards and dashlets show all cases, regardless of whether those contacts are visible.</p>
  
  <p>Is this expected behaviour, or have I went wrong somewhere?</p>
  
  <p><strong>Drupal permission:</strong></p>
  
  <blockquote>
    <p>CiviCase: access all cases and activities <em>View and edit all cases (for visible contacts)</em></p>
  </blockquote>
  
Tags: <civicase><permissions>
Title: CiviCase not strictly adhering to permissions?
ThreadText: # CiviCase not strictly adhering to permissions?
  
  (Asked by: username_0 on 2019-10-21)
  
  I have a use case where 'volunteers' deal with casework on an area basis, with a 'supervisor' for each area. Volunteers can add contacts, and view their own cases. Supervisors can view all cases.
  
  Both roles' access to their area's contacts is limited by Civi's own ACL through each service user being assigned to an area group.
  
  This works up to a point, in that neither group has permission to view cases outside their area, but supervisors' dashboards and dashlets show all cases, regardless of whether those contacts are visible.
  
  Is this expected behaviour, or have I went wrong somewhere?
  
  **Drupal permission:**
  
  > CiviCase: access all cases and activities *View and edit all cases (for visible contacts)*
  
  **Tags:** civicase, permissions
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-10-22. Score: 1
  
  You might be right. The dashboard as far as I can remember has never used ACL's it just uses "my" or "all". The feature where ACL support for case was introduced might have been for a different need and doesn't seem to have included the dashboard (<https://issues.civicrm.org/jira/browse/CRM-17645>).
  
  So yes and no to your question?
  
  
  ---
  
  