I've been asked by a client if one of their members can be allowed to create and edit records for prospects (ie people who may or may not go on to become actual members).

The first part - creating a simple data entry form as a profile - was easy to do. I can give the member unique access to a webpage which contains that form. But what I'm not sure about is record editing. Does the member need to have access to Civi itself? I created a 'Prospect Admin' ACL and assigned it to the member through a Prospect Admin Group. But I'm not sure where we go from here. Is it possible to set it up so the member is able to access and edit prospect records without being able to edit the WordPress site?

Any advice would be welcome!

2 Answers 2


There are a couple of different ways you can go about this.

  • One would be to grant access to CiviCRM, and the bare minimum WordPress access needed to actually get into CiviCRM. You would remove the "View all CiviCRM contacts" permission from this role (also "Edit all CiviCRM contacts") and then they only have access to contacts based on their ACL. This method gives the member access to the CiviCRM interface.

  • The second method is conjecture based on a similar technique I've used with Drupal Webform-CiviCRM integration - but I'm guessing you could use a contact reference widget on Caldera Forms CiviCRM to let a (privileged) member pull up and edit existing records. This is a bit more work, but lets you limit the interface that the member sees to the relevant fields.

If you go with the first approach, consider the Contact Layout Editor extension to give the member(s) a more limited view of the CiviCRM interface, so they can't view/edit fields/tabs they ought not to.

  • Thanks - that sounds useful. I will pursue 1 first. I had vaguely considered trying something with Caldera - when developing the site I used it successfully to create a new member record form. As you say, it might be a useful way of avoiding letting the member see under the bonnet. Sep 23, 2019 at 21:03
  • Just to second this approach. We run kids clubs so safeguarding is my big issue. I've created a new WP user type called 'Ambassador' and given it subscriber rights in WP. That way it can log in and see Civi, but has no other WP rights. Then you set up the ACL as Jon suggests. My ambassadors can now see, and update records for young people in their club, but can't see young people from other clubs. A bit fiddly the one time when you set it up, but works really well. Sep 25, 2019 at 9:20

Rather than using ACLs, another approach would be to use the ACLs the Permissioned Relationships extension provides - https://civicrm.org/extensions/relationship-permissions-acls

If when cfreating contacts, you also set up the Relationship, then you can give access to the backend such that the restricted users will only see the Contacts they have a permissioned relationship with.

This can be further extended by allowing second degree permissions. (If the second degree permissions is checked then on admin/misc screen)

May be useful to you

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.