Answers.Body: <p>I found a suitable Plugin: Group Administrators does the Job! Great Plugin</p>
  <p><a href="https://civicrm.org/extensions/group-administrators" rel="nofollow noreferrer">https://civicrm.org/extensions/group-administrators</a></p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-01-26T20:34:45.420Z
Answers.Text: great. thx for sharing - i don't think i was familiar with that one
Answers.UserDisplayName: petednz - fuzion
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2024-01-26T19:04:17.877Z
Answers.LastActivityDate: 2024-01-26T19:04:17.877Z
Answers.UserDisplayName: BennHi
Body: <p>I am trying to setup our Civi with a horizontal and vertical permission structure for different departments and roles. By horizontal I mean what's configured in WP Permissions such as access to CiviComponents and their actions so every department can have an &quot;admin&quot; and a &quot;hand&quot; group. By vertical I mean what's controlled by ACLs such that a department has only access to data within the respective groups.</p>
  <p>For example the Membership department would have three Groups, &quot;Membership Admin&quot;, &quot;Membership Hand&quot; (both of which are access control groups) and &quot;Member&quot;. The Admin Group has access to read/write/delete Contacts and extensive access to CiviMember rules but is restricted in ACLs to read/edit only Members of the &quot;Membership Admin&quot;, &quot;Membership Hand&quot; and &quot;Member&quot; Groups. The Hand would then have a more restricted ruleset and ACLs to read/edit and &quot;Members&quot; only.</p>
  <p>But the unexpected behavior I encountered is that Members of both Admin and Hand groups cannot add nor remove anyone to the Groups visible to them. I can confirm that Groups are visible to them as expected but when I try to remove a Group from a Contact down the chain of access I get an Error &quot;<em>API permission check failed for GroupContact/delete call; insufficient permission: require access CiviCRM and edit all contacts</em>&quot;. And also the Button to add a contact to a Group is not being shown in the contact-&gt;groups window. When trying to add contacts via the manage groups menu I get &quot;<em>Select Group is a required field</em>&quot; at the last step when trying to confirm the action and the field for the target group is empty.</p>
  <p>Is there a way to fix this? I found a couple of posts regarding this behavior here but no solution. And grating &quot;edit all Contacts&quot; is no feasible option as it would grant access to all contacts.</p>
  <p>Help is much appreciated!</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2024-01-24T00:14:18.493Z
Comments.Text: Hi - haven't read the detail of what you are trying to do, but perhaps familiarise yourself with this extension in case it could take some of the pain away https://civicrm.org/extensions/relationship-permissions-acls
Comments.UserDisplayName: petednz - fuzion
Tags: <wordpress><permissions><groups><acl>
Title: ACLs and Permission to add to Groups
ThreadText: # ACLs and Permission to add to Groups
  
  (Asked by: username_0 on 2024-01-22)
  
  I am trying to setup our Civi with a horizontal and vertical permission structure for different departments and roles. By horizontal I mean what's configured in WP Permissions such as access to CiviComponents and their actions so every department can have an "admin" and a "hand" group. By vertical I mean what's controlled by ACLs such that a department has only access to data within the respective groups.
  
  For example the Membership department would have three Groups, "Membership Admin", "Membership Hand" (both of which are access control groups) and "Member". The Admin Group has access to read/write/delete Contacts and extensive access to CiviMember rules but is restricted in ACLs to read/edit only Members of the "Membership Admin", "Membership Hand" and "Member" Groups. The Hand would then have a more restricted ruleset and ACLs to read/edit and "Members" only.
  
  But the unexpected behavior I encountered is that Members of both Admin and Hand groups cannot add nor remove anyone to the Groups visible to them. I can confirm that Groups are visible to them as expected but when I try to remove a Group from a Contact down the chain of access I get an Error "*API permission check failed for GroupContact/delete call; insufficient permission: require access CiviCRM and edit all contacts*". And also the Button to add a contact to a Group is not being shown in the contact->groups window. When trying to add contacts via the manage groups menu I get "*Select Group is a required field*" at the last step when trying to confirm the action and the field for the target group is empty.
  
  Is there a way to fix this? I found a couple of posts regarding this behavior here but no solution. And grating "edit all Contacts" is no feasible option as it would grant access to all contacts.
  
  Help is much appreciated!
  
  **Tags:** wordpress, permissions, groups, acl
  
  > **Comments:**
  > **username_1**: Hi - haven't read the detail of what you are trying to do, but perhaps familiarise yourself with this extension in case it could take some of the pain away https://civicrm.org/extensions/relationship-permissions-acls  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2024-01-26. Score: 1 | Accepted answer
  
  I found a suitable Plugin: Group Administrators does the Job! Great Plugin
  
  <https://civicrm.org/extensions/group-administrators>
  
  > **Comments:**
  > **username_1**: great. thx for sharing - i don't think i was familiar with that one  
  
  ---
  
  