Answers.Body: <p>While it's more work to set up, I think you'd be very well served by taking advantage of <a href="http://wiki.civicrm.org/confluence/display/CRMDOC/Multi+Site+Installation" rel="nofollow noreferrer">multi-site</a> capabilities of CiviCRM, especially in conjunction with the excellent <a href="https://github.com/eileenmcnaughton/org.civicrm.multisite" rel="nofollow noreferrer">Multi-site Permissioning extension</a>.  That said - I'm very nervous recommending these tools to someone who hasn't set up CiviCRM before!  It takes a fair amount of web development know-how to get this all working.</p>
  
  <p>This would get you two-tier permissioning for "free".  You need three tiers - local, national, international.  I'd probably give each local group their own site - using <a href="https://www.drupal.org/project/domain" rel="nofollow noreferrer">Domain Access</a> for Drupal or <a href="http://codex.wordpress.org/Create_A_Network" rel="nofollow noreferrer">Wordpress multisite</a>.  Then I'd handle the national level via ACLs.  Hopefully someone might also give good advice on <a href="https://civicrm.stackexchange.com/questions/505/how-to-do-three-tiered-multi-site">my related question here</a>.</p>
  
  <p>The alternative approach is to write a custom permission extension.  This has a performance benefit, and also leads to much easier management.  However, this requires a much higher level of skill!  I'd say the two shops with proven expertise here are <a href="http://www.fuzion.co.nz/contact" rel="nofollow noreferrer">Fuzion</a> and <a href="http://jmaconsulting.biz/" rel="nofollow noreferrer">JMA Consulting</a>.  If you're a developer yourself, the Multisite Permissioning extension above is a good example to get you started.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-15T20:23:10.540Z
Answers.LastActivityDate: 2015-04-15T20:23:10.540Z
Answers.LastEditDate: 2017-04-13T12:53:13.207Z
Answers.UserDisplayName: Jon G - Megaphone Tech
Answers.Body: <p>I don't know if your local groups correspond to counties (or county equivalents).  If so, you might install the <a href="https://github.com/nditech/org.ndi.civi-local-permissions" rel="nofollow">local permissions extension we built for the National Democratic Institute</a>. It allows you to grant certain roles permission to view/edit contacts in their county, and others permission over their state, all using the contacts' addresses (avoiding having to create 340+ groups, one for each center's contacts and one for each center's leaders.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-04-16T23:58:38.937Z
Answers.LastActivityDate: 2015-04-16T23:58:38.937Z
Answers.UserDisplayName: Andie Hunt
Body: <p>For my first CiviCRM implementation I need to set it up for an organization that has several national branches, each with a number of centres.
  Contacts belong to a centre and therefore its country.</p>
  
  <p>Role permissions are needed at different levels:
  - local managers should be able to view/edit only contacts within their own centre;
  - national managers should be able to view/edit only contacts within the same country;
  - international managers can access all contacts.</p>
  
  <p><a href="http://wiki.civicrm.org/confluence/display/CRMDOC/Multi-level+Organization+ACL+Permissions">This page</a> of the CiviCRM's wiki is a promising start to give ideas, but it never got completed.</p>
  
  <p>I've made a few attempts using Option Groups, Custom Fields mapped to Smart Groups, but I did not really go anywhere also because the idea of managing about 170 centres in 22 countries that way seems a bit cumbersome.</p>
  
  <p>Can anyone give me ideas on the best approach to handle this ?</p>
  
Tags: <groups><acl>
Title: Multi-level Organization ACL Permissions
ThreadText: # Multi-level Organization ACL Permissions
  
  (Asked by: username_0 on 2015-04-15)
  
  For my first CiviCRM implementation I need to set it up for an organization that has several national branches, each with a number of centres.
  Contacts belong to a centre and therefore its country.
  
  Role permissions are needed at different levels:
  - local managers should be able to view/edit only contacts within their own centre;
  - national managers should be able to view/edit only contacts within the same country;
  - international managers can access all contacts.
  
  [This page](http://wiki.civicrm.org/confluence/display/CRMDOC/Multi-level+Organization+ACL+Permissions) of the CiviCRM's wiki is a promising start to give ideas, but it never got completed.
  
  I've made a few attempts using Option Groups, Custom Fields mapped to Smart Groups, but I did not really go anywhere also because the idea of managing about 170 centres in 22 countries that way seems a bit cumbersome.
  
  Can anyone give me ideas on the best approach to handle this ?
  
  **Tags:** groups, acl
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2015-04-15. Score: 5
  
  While it's more work to set up, I think you'd be very well served by taking advantage of [multi-site](http://wiki.civicrm.org/confluence/display/CRMDOC/Multi+Site+Installation) capabilities of CiviCRM, especially in conjunction with the excellent [Multi-site Permissioning extension](https://github.com/eileenmcnaughton/org.civicrm.multisite). That said - I'm very nervous recommending these tools to someone who hasn't set up CiviCRM before! It takes a fair amount of web development know-how to get this all working.
  
  This would get you two-tier permissioning for "free". You need three tiers - local, national, international. I'd probably give each local group their own site - using [Domain Access](https://www.drupal.org/project/domain) for Drupal or [Wordpress multisite](http://codex.wordpress.org/Create_A_Network). Then I'd handle the national level via ACLs. Hopefully someone might also give good advice on [my related question here](https://civicrm.stackexchange.com/questions/505/how-to-do-three-tiered-multi-site).
  
  The alternative approach is to write a custom permission extension. This has a performance benefit, and also leads to much easier management. However, this requires a much higher level of skill! I'd say the two shops with proven expertise here are [Fuzion](http://www.fuzion.co.nz/contact) and [JMA Consulting](http://jmaconsulting.biz/). If you're a developer yourself, the Multisite Permissioning extension above is a good example to get you started.
  
  
  ---
  
  ### Answer by username_2 on 2015-04-16. Score: 2
  
  I don't know if your local groups correspond to counties (or county equivalents). If so, you might install the [local permissions extension we built for the National Democratic Institute](https://github.com/nditech/org.ndi.civi-local-permissions). It allows you to grant certain roles permission to view/edit contacts in their county, and others permission over their state, all using the contacts' addresses (avoiding having to create 340+ groups, one for each center's contacts and one for each center's leaders.
  
  
  ---
  
  