How to fake a 'deny' ACL

Question

Has anyone ever tried to deny access to a group of custom fields, for particular roles/users? We have a custom-data tab that we'd like only particular roles to see. I know there's no 'deny' ACL, but I'm wondering if it can be faked through hooks.

I figure I can hide the tab using hook_civicrm_tabs, and kill any exports using hook_civicrm_export. Would there be much more to it than that? Or is this just entirely impractical, as there'll always be some way around it?

I appreciate we could flip it all around and start with a more restrictive set of permissions. Then create ACLs that allow access. But we have a lot of custom fields and a lot of different roles - so this would be a pretty big admin burden. And we only rarely need to deny anything.

EDIT: we're on WordPress, which doesn't have a 'deny' ACL available.

Answer 1

It should be possible in WordPress also. WP + Civi has the same capabilities as drupal and joomla.

Deny ACLs are not part of the UI. You can implement them via a hook. Check:

https://civicrm.org/blog/lobo/implementing-a-custom-acl-system-in-civicrm

(search for VIP contacts)

Answer 2

Yes, you can deny access for each set of custom field set

just give a read http://book.civicrm.org/user/current/initial-set-up/permissions-and-access-control/ which explain. I guess this helps

if you need some example please let me know will update you in details