We are slowly building our back office team, and so I am having to struggle my way through permissions and ACLs.
I would like to have a user who can:
- View any user's record (and we limit their view using the Contact Summary Layouts extension)
- NOT edit a user's record -- because that lets them see all the data we are hiding with Contact Summary Layout
- BUT send mail with CiviMail
My understanding is that CiviMail requires the user to have EDIT permission on groups that they will send to. We have defined 5 groups that this user should be able to send mail to, and we have given that user EDIT permission on those groups. However, this also seems to allow them to edit the user's individual record and see data they shouldn't.
Question: Am I understanding the ACLs correctly?
I have thought of two ways around this:
Don't give our backoffice staff the ability to view contacts at all in the CiviCRM UI. Build Drupal views for them to see whatever data they want to see. Then they only get access to CiviMail in the CiviCRM UI. Not sure if this is truly possible but that's one thought.
Have our backoffice staff have one user that can view users but cannot use CiviMail, and a different user account that can do CiviMail but not view individual contact records (and therefore not edit them).
Question: Do either of these two options make sense?
And Question: And is there any better option?
Thank you so much!