Multi-level Organization ACL Permissions

Question

For my first CiviCRM implementation I need to set it up for an organization that has several national branches, each with a number of centres. Contacts belong to a centre and therefore its country.

Role permissions are needed at different levels: - local managers should be able to view/edit only contacts within their own centre; - national managers should be able to view/edit only contacts within the same country; - international managers can access all contacts.

This page of the CiviCRM's wiki is a promising start to give ideas, but it never got completed.

I've made a few attempts using Option Groups, Custom Fields mapped to Smart Groups, but I did not really go anywhere also because the idea of managing about 170 centres in 22 countries that way seems a bit cumbersome.

Can anyone give me ideas on the best approach to handle this ?

Answer 1

While it's more work to set up, I think you'd be very well served by taking advantage of multi-site capabilities of CiviCRM, especially in conjunction with the excellent Multi-site Permissioning extension. That said - I'm very nervous recommending these tools to someone who hasn't set up CiviCRM before! It takes a fair amount of web development know-how to get this all working.

This would get you two-tier permissioning for "free". You need three tiers - local, national, international. I'd probably give each local group their own site - using Domain Access for Drupal or Wordpress multisite. Then I'd handle the national level via ACLs. Hopefully someone might also give good advice on my related question here.

The alternative approach is to write a custom permission extension. This has a performance benefit, and also leads to much easier management. However, this requires a much higher level of skill! I'd say the two shops with proven expertise here are Fuzion and JMA Consulting. If you're a developer yourself, the Multisite Permissioning extension above is a good example to get you started.

Answer 2

I don't know if your local groups correspond to counties (or county equivalents). If so, you might install the local permissions extension we built for the National Democratic Institute. It allows you to grant certain roles permission to view/edit contacts in their county, and others permission over their state, all using the contacts' addresses (avoiding having to create 340+ groups, one for each center's contacts and one for each center's leaders.