Answers.Body: <p>You could do that with <a href="https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_aclWhereClause/" rel="nofollow noreferrer">hook_civicrm_aclWhereClause</a>:</p>
  
  <ul>
  <li>remove 'view all contacts', 'edit all contacts' for the case worker</li>
  <li>create an extension implementing <code>hook_civicrm_aclWhereClause</code> eg:</li>
  </ul>
  
  <p><code>function everyoneexcept_civicrm_aclWhereClause($type, &amp;$tables, $whereTables, &amp;$contactID, &amp;$where) {
        if ($contactID == 'your_case_worker_id') {
          $where .= ($where ? ' AND ' : '') . " contact_a.id != 'your_case_worker_relative_id'";
        }
      }
  </code></p>
  
  <p>For a one-off case, just hardcode the contact id's for your case worker and their relative.</p>
  
  <p>Caveat - not extensively tested!</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-12-06T23:05:17.373Z
Answers.Text: This is a lifesaver @aidan!  I didn't realize that in "vanilla" ACLs, you're controlling both access to the groups AND the contacts in the groups.  This technique is perfect if you want to hide contacts in a group, but let users see all the groups.
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-06-05T10:33:54.057Z
Answers.LastActivityDate: 2018-06-05T10:33:54.057Z
Answers.UserDisplayName: Aidan
Body: <p>My user would like a particular case worker to be prevented from accessing one specific client.  At present we're not using ACLs but I implemented one scheme that I could get to work on my test system but not on their system - I have almost given up trying to figure out why. I created a smart group with all clients except the excluded one, and a group with the case worker who could see only this group. Can anyone suggest another way this can be achieved? </p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-05-31T08:00:26.397Z
Comments.Text: My suggestion would be something similair to solve it technically. But my gutfeeling is that there are some organizational issues at your client. Why is one particilair case worker not allowed to see one particilair client? What is the reasons behind that and how else could that be solved? My first gutfeeling is that you are trying to solve conflict avoidance behaviour if it is that behaviour that needs to be addressed first before providing a technical solution.
Comments.UserDisplayName: Jaap Jansma - CiviCooP
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-05-31T08:01:59.100Z
Comments.Text: Above is my gutfeeling and I could be completly wrong. But at least it is worth trying to figure what reasoning behind the request is.
Comments.UserDisplayName: Jaap Jansma - CiviCooP
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2018-05-31T13:24:29.073Z
Comments.Text: The 2 people are related, and I agree that a technical solution is possibly not the best. But I'm still trying to work out a good way to solve this
Comments.UserDisplayName: Andy Clark
Tags: <drupal><acl><5.1.0>
Title: Simple way to prevent one user seeing one contact
ThreadText: # Simple way to prevent one user seeing one contact
  
  (Asked by: username_0 on 2018-05-28)
  
  My user would like a particular case worker to be prevented from accessing one specific client. At present we're not using ACLs but I implemented one scheme that I could get to work on my test system but not on their system - I have almost given up trying to figure out why. I created a smart group with all clients except the excluded one, and a group with the case worker who could see only this group. Can anyone suggest another way this can be achieved?
  
  **Tags:** drupal, acl, 5.1.0
  
  > **Comments:**
  > **username_1**: My suggestion would be something similair to solve it technically. But my gutfeeling is that there are some organizational issues at your client. Why is one particilair case worker not allowed to see one particilair client? What is the reasons behind that and how else could that be solved? My first gutfeeling is that you are trying to solve conflict avoidance behaviour if it is that behaviour that needs to be addressed first before providing a technical solution.  
  > **username_1**: Above is my gutfeeling and I could be completly wrong. But at least it is worth trying to figure what reasoning behind the request is.  
  > **username_0**: The 2 people are related, and I agree that a technical solution is possibly not the best. But I'm still trying to work out a good way to solve this  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2018-06-05. Score: 3
  
  You could do that with [hook\_civicrm\_aclWhereClause](https://docs.civicrm.org/dev/en/latest/hooks/hook_civicrm_aclWhereClause/):
  
  * remove 'view all contacts', 'edit all contacts' for the case worker
  * create an extension implementing `hook_civicrm_aclWhereClause` eg:
  
  `function everyoneexcept_civicrm_aclWhereClause($type, &$tables, $whereTables, &$contactID, &$where) {
  if ($contactID == 'your_case_worker_id') {
  $where .= ($where ? ' AND ' : '') . " contact_a.id != 'your_case_worker_relative_id'";
  }
  }`
  
  For a one-off case, just hardcode the contact id's for your case worker and their relative.
  
  Caveat - not extensively tested!
  
  > **Comments:**
  > **username_3**: This is a lifesaver @username_2!  I didn't realize that in "vanilla" ACLs, you're controlling both access to the groups AND the contacts in the groups.  This technique is perfect if you want to hide contacts in a group, but let users see all the groups.  
  
  ---
  
  