Answers.Body: <p>I believe your analysis is correct, i.e. the permission to view event participants also include creating/editing events:</p>
  <pre><code>CiviEvent: access CiviEvent
  Create events, view all events, and view participant records (for visible contacts)
  </code></pre>
  <p>But of course, as coleman would say, you can always use searchkit.</p>
  <p>Specifically, you could create a custom search, grant access to it for a role that doesn't have access to the 'access CiviEvent' permission, and have it list participants for events.</p>
  <p>For bonus points, it could be a tailored listing!</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-12-05T14:03:52.087Z
Answers.Text: Thanks - yes, I see that Searchkit could be used, but this seems like a flaw in the permissions structure to me, in that simply finding participants _shouldn't_ be paired with the ability to create events.  I appreciate the suggestion and the confirmation I'm not misunderstanding the permissions though!
Answers.UserDisplayName: Lesley Carter - BackOffice
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-12-05T20:12:31.387Z
Answers.Text: I would not call this a flaw, I'd call it a limitation, and with SearchKit, not even a serious one. At other times, new permissions have been created to deal with new use cases like this, and the result is now an unmanageable collection of permissions that are very hard to manage (creating a lot of scope for security concerns). So, I'll disagree!
Answers.UserDisplayName: Alan Dixon
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-12-04T15:32:59.373Z
Answers.LastActivityDate: 2024-12-04T15:32:59.373Z
Answers.UserDisplayName: Alan Dixon
Body: <p>CiviCRM 5.75.6, Drupal 10.3.6.  Trying to restrict access to create/manage events without also removing the ability to search for participants.  Although &quot;View event participants&quot; is a distinct permission, I'm finding that if I remove &quot;Access CiviEvent&quot; from a role, they lose access to the participant search, even though they <em>do</em> have the &quot;view event participants&quot; permission.  This doesn't seem right to me - is there something else I'm missing?  (I also tested adding an event ACL to see if that would solve my problem but it appears to have no impact on access to create/manage events whatsoever.)</p>
  
Tags: <civievent><permissions>
Title: Granting access to find participants without also granting access to create/manage events
ThreadText: # Granting access to find participants without also granting access to create/manage events
  
  (Asked by: username_0 on 2024-12-03)
  
  CiviCRM 5.75.6, Drupal 10.3.6. Trying to restrict access to create/manage events without also removing the ability to search for participants. Although "View event participants" is a distinct permission, I'm finding that if I remove "Access CiviEvent" from a role, they lose access to the participant search, even though they *do* have the "view event participants" permission. This doesn't seem right to me - is there something else I'm missing? (I also tested adding an event ACL to see if that would solve my problem but it appears to have no impact on access to create/manage events whatsoever.)
  
  **Tags:** civievent, permissions
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-12-04. Score: 0
  
  I believe your analysis is correct, i.e. the permission to view event participants also include creating/editing events:
  
  ```
  CiviEvent: access CiviEvent
  Create events, view all events, and view participant records (for visible contacts)
  
  ```
  
  But of course, as coleman would say, you can always use searchkit.
  
  Specifically, you could create a custom search, grant access to it for a role that doesn't have access to the 'access CiviEvent' permission, and have it list participants for events.
  
  For bonus points, it could be a tailored listing!
  
  > **Comments:**
  > **username_0**: Thanks - yes, I see that Searchkit could be used, but this seems like a flaw in the permissions structure to me, in that simply finding participants _shouldn't_ be paired with the ability to create events.  I appreciate the suggestion and the confirmation I'm not misunderstanding the permissions though!  
  > **username_1**: I would not call this a flaw, I'd call it a limitation, and with SearchKit, not even a serious one. At other times, new permissions have been created to deal with new use cases like this, and the result is now an unmanageable collection of permissions that are very hard to manage (creating a lot of scope for security concerns). So, I'll disagree!  
  
  ---
  
  