CiviMail ACL permissions question

Question

We are slowly building our back office team, and so I am having to struggle my way through permissions and ACLs.

I would like to have a user who can:

1. View any user's record (and we limit their view using the Contact Summary Layouts extension)
2. NOT edit a user's record -- because that lets them see all the data we are hiding with Contact Summary Layout
3. BUT send mail with CiviMail

My understanding is that CiviMail requires the user to have EDIT permission on groups that they will send to. We have defined 5 groups that this user should be able to send mail to, and we have given that user EDIT permission on those groups. However, this also seems to allow them to edit the user's individual record and see data they shouldn't.

Question: Am I understanding the ACLs correctly?

I have thought of two ways around this:

1. Don't give our backoffice staff the ability to view contacts at all in the CiviCRM UI. Build Drupal views for them to see whatever data they want to see. Then they only get access to CiviMail in the CiviCRM UI. Not sure if this is truly possible but that's one thought.

2. Have our backoffice staff have one user that can view users but cannot use CiviMail, and a different user account that can do CiviMail but not view individual contact records (and therefore not edit them).

Question: Do either of these two options make sense?

And Question: And is there any better option?

Thank you so much!

Answer 1

You should be able to create a role that has the permission "View all Contacts" as well as "edit groups" and "access civimail". That should allow them to do what you described (see contacts but not edit them and use CiviMail) without ACL-Permissions.

There may be solutions to archieve your goals with Drupal Views but I expect that approach to be more complicated - also I think you need "view contact" permission to use groups in CiviMail.

Some more thoughts:

• Contact Summary Layout is only hiding information from the UI but not technically restricting access. There may be ways for users to work around that and access information they are not supposed to.
• If possible I would strongly recommend to avoid ACL-permissions - imho it is very complex and somewhat limited. If you are interested have a look at this thread as well as those linked in it.