Answers.Body: <p>The ACLs in CiviCRM are only additive.  So assuming a user doesn't have the "View All Contacts" or "Edit All Contacts" permissions (which overrides all ACLs), the default is that a user can view zero contacts.</p>
  
  <p>So to answer your second question: If you grant the user permission to access contacts in Group A, all contacts in Group A are accessible to the user - even if they're in Group B, which the user doesn't have access to.</p>
  
  <p>This, in turn, should answer your first question - the ACL applies to the contacts in a group.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-20T08:34:37.353Z
Answers.Text: Thanks for this @jon-g. A quick follow up to clarify: if the user cannot access contacts in Group A, can they see Group A listed in a listing of groups, or is the group hidden from them?
Answers.UserDisplayName: Graham
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-20T18:35:42.997Z
Answers.Text: Generally speaking, the group is hidden from them - though I've seen instances where this wasn't the case.  E.g. from Civi 4.6.0 to 4.6.6, the groups would still appear when selecting groups to do a mailing.
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-20T13:09:39.863Z
Answers.Text: I am using Civi 4.6.10 and though some users are not given access to some groups, they can still see all groups listed in search /civicrm/contact/search?reset=1
Answers.UserDisplayName: Kboy
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-11-20T13:25:23.313Z
Answers.Text: @ Jon G, I am using Civi 4.6.10 and though some users are not given access to some groups, they can still see all groups listed in search /civicrm/contact/search?reset=1. Is there anyway to hide group listing from the search? If the group is listed it means than user can still search for contacts in a group that they are not supposed to access if a contact exists in two groups (A and B) considering user has access to GroupA,  will see contact in group B, only difference is that clicking on the contact's group tab doesn't show Group B.
Answers.UserDisplayName: Kboy
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-09-20T01:59:03.897Z
Answers.LastActivityDate: 2015-09-20T01:59:03.897Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Body: <p>As I understand it I can use CiviCRM's Access Control Lists to to control the groups that users can see and work with. But I'm not clear on a few points about this:</p>
  
  <p>If a user does not have the permission to see a given group (for example in a list of groups) can they still see and work with the contacts in that group? Or to put it another way, when the ACL refers to a "group of contacts" does the permission that is granted by the ACL apply to the group, or the contacts within that group, or both?</p>
  
  <p>And following on from that, if a contact is in two groups, and a user has permission to view one group but not the other, can the user see the contact at all?</p>
  
Tags: <groups><acl>
Title: Using ACLs to manage access to contacts
ThreadText: # Using ACLs to manage access to contacts
  
  (Asked by: username_0 on 2015-09-18)
  
  As I understand it I can use CiviCRM's Access Control Lists to to control the groups that users can see and work with. But I'm not clear on a few points about this:
  
  If a user does not have the permission to see a given group (for example in a list of groups) can they still see and work with the contacts in that group? Or to put it another way, when the ACL refers to a "group of contacts" does the permission that is granted by the ACL apply to the group, or the contacts within that group, or both?
  
  And following on from that, if a contact is in two groups, and a user has permission to view one group but not the other, can the user see the contact at all?
  
  **Tags:** groups, acl
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2015-09-20. Score: 5 | Accepted answer
  
  The ACLs in CiviCRM are only additive. So assuming a user doesn't have the "View All Contacts" or "Edit All Contacts" permissions (which overrides all ACLs), the default is that a user can view zero contacts.
  
  So to answer your second question: If you grant the user permission to access contacts in Group A, all contacts in Group A are accessible to the user - even if they're in Group B, which the user doesn't have access to.
  
  This, in turn, should answer your first question - the ACL applies to the contacts in a group.
  
  > **Comments:**
  > **username_0**: Thanks for this @jon-g. A quick follow up to clarify: if the user cannot access contacts in Group A, can they see Group A listed in a listing of groups, or is the group hidden from them?  
  > **username_1**: Generally speaking, the group is hidden from them - though I've seen instances where this wasn't the case.  E.g. from Civi 4.6.0 to 4.6.6, the groups would still appear when selecting groups to do a mailing.  
  > **username_2**: I am using Civi 4.6.10 and though some users are not given access to some groups, they can still see all groups listed in search /civicrm/contact/search?reset=1  
  > **username_2**: @ Jon G, I am using Civi 4.6.10 and though some users are not given access to some groups, they can still see all groups listed in search /civicrm/contact/search?reset=1. Is there anyway to hide group listing from the search? If the group is listed it means than user can still search for contacts in a group that they are not supposed to access if a contact exists in two groups (A and B) considering user has access to GroupA,  will see contact in group B, only difference is that clicking on the contact's group tab doesn't show Group B.  
  
  ---
  
  