Answers.Body: <blockquote>
  <p>So far, all I can see are ways to enable access to things (like
  enabling access to View the groups) but I can't see how to restrict
  access to anything.</p>
  </blockquote>
  <p>Yes - that's the key to understanding these permissions.  A user starts with no permission and is granted bits of access via the CMS permissions and ACL's.</p>
  <p>If a user should have access to all contacts you will normally grant that via the 'CiviCRM: view all contacts' CMS permission - and in a simple setup where all users see all contacts then all users will have that permission.</p>
  <p>So if you want your Volunteers not to view those in the Private Group, you need to remove the 'CiviCRM: view all contacts' CMS permission from the Volunteers and then <em>grant</em> them access to all contacts <em>except</em> those in Private Group.  You also need to make sure that non-volunteers can access Private Group contacts, so you may want your Volunteers to be a different CMS role from non-volunteers.</p>
  <p>That is awkward and a better way of handling the scenario you describe would be useful.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-02-15T15:02:33.350Z
Answers.Text: Unfortunately, following this approach, every time a new group is created, there will be an extra step of going to add access to the new group to the non-volunteers access control.  This is not desirable because access control is more of an admin privilege and will make things difficult for an average user.
Answers.UserDisplayName: flantascience
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2022-02-14T10:01:53.683Z
Answers.LastActivityDate: 2022-02-14T10:01:53.683Z
Answers.UserDisplayName: Aidan
Body: <p>I'm working on a CiviCRM system which has volunteers who we need to restrict access to specific contact information.</p>
  <p>I've created a group for the Volunteers as well as a group (called Private Contacts) for those people whose contact information needs to be hidden.  I also created an ACL for Volunteers and a Group for Volunteers and placed the Volunteers into the Group.  I also setup an ACL allowing them to view Contacts in All Groups.</p>
  <p>The result is the Volunteers are getting full access to all the contact information for the users in the Private Contact group.</p>
  <p>So far, all I can see are ways to enable access to things (like enabling access to View the groups) but I can't see how to restrict access to anything.</p>
  <p>Is there a setting that I am missing?</p>
  <p>For example, if I want to hide the mailing address or cell phones for the volunteer users.  Or, better yet, if the volunteer users were not able to view the list of contacts that are part of the Private Group.</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2022-02-15T15:05:23.547Z
Comments.Text: I created a CMS role called 'volunteer' though I'm not sure what capabilities I would need to alter in order to restrict their access to the 'Private Group'
Comments.UserDisplayName: flantascience
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2022-02-11T02:36:21.957Z
Comments.Text: have you also confirmed what CMS roles and permissions they have. sounds like you need to restrict things there.
Comments.UserDisplayName: petednz - fuzion
Tags: <acl><roles>
Title: How to restrict access to certain information for non-admin users (i.e. volunteers)
ThreadText: # How to restrict access to certain information for non-admin users (i.e. volunteers)
  
  (Asked by: username_0 on 2022-02-10)
  
  I'm working on a CiviCRM system which has volunteers who we need to restrict access to specific contact information.
  
  I've created a group for the Volunteers as well as a group (called Private Contacts) for those people whose contact information needs to be hidden. I also created an ACL for Volunteers and a Group for Volunteers and placed the Volunteers into the Group. I also setup an ACL allowing them to view Contacts in All Groups.
  
  The result is the Volunteers are getting full access to all the contact information for the users in the Private Contact group.
  
  So far, all I can see are ways to enable access to things (like enabling access to View the groups) but I can't see how to restrict access to anything.
  
  Is there a setting that I am missing?
  
  For example, if I want to hide the mailing address or cell phones for the volunteer users. Or, better yet, if the volunteer users were not able to view the list of contacts that are part of the Private Group.
  
  **Tags:** acl, roles
  
  > **Comments:**
  > **username_1**: have you also confirmed what CMS roles and permissions they have. sounds like you need to restrict things there.  
  > **username_0**: I created a CMS role called 'volunteer' though I'm not sure what capabilities I would need to alter in order to restrict their access to the 'Private Group'  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2022-02-14. Score: 2
  
  > So far, all I can see are ways to enable access to things (like
  > enabling access to View the groups) but I can't see how to restrict
  > access to anything.
  
  Yes - that's the key to understanding these permissions. A user starts with no permission and is granted bits of access via the CMS permissions and ACL's.
  
  If a user should have access to all contacts you will normally grant that via the 'CiviCRM: view all contacts' CMS permission - and in a simple setup where all users see all contacts then all users will have that permission.
  
  So if you want your Volunteers not to view those in the Private Group, you need to remove the 'CiviCRM: view all contacts' CMS permission from the Volunteers and then *grant* them access to all contacts *except* those in Private Group. You also need to make sure that non-volunteers can access Private Group contacts, so you may want your Volunteers to be a different CMS role from non-volunteers.
  
  That is awkward and a better way of handling the scenario you describe would be useful.
  
  > **Comments:**
  > **username_0**: Unfortunately, following this approach, every time a new group is created, there will be an extra step of going to add access to the new group to the non-volunteers access control.  This is not desirable because access control is more of an admin privilege and will make things difficult for an average user.  
  
  ---
  
  