How Joomla ACL Permissions Work
Joomla's Access Control List (ACL) determines whether users may perform actions and, together with viewing access levels, what site items they may see. The key is that Joomla evaluates permissions for the user's groups across a hierarchy rather than treating every permission selector as an isolated switch.
Users receive ACL context through user groups
Users are assigned to one or more groups. Groups can have parent-child relationships, so effective membership includes the relevant parent chain. Build permissions around groups rather than trying to configure privileges separately for every individual user.
Action permissions are evaluated against Joomla assets
Joomla components define actions such as create, edit, delete, edit state, or configuration access. Permissions can be defined at levels such as Global Configuration, component options, categories, and individual items where the component supports them. Joomla's developer documentation describes these rules as being associated with an asset hierarchy.
Allowed and Denied are not equal opposites
Joomla evaluates the user's applicable group rules through the hierarchy. An explicit Denied at an applicable higher level cannot be overridden by setting Allowed lower down. If no Denied applies and at least one applicable group grants the action, the action can be allowed. If no applicable rule grants it, the action is not permitted.
The Calculated Setting is what matters
When editing permissions in Joomla Administrator, save the change and inspect the Calculated Setting or effective result. The selector you changed is only one input; parent groups and higher-level ACL rules can alter the final result.
Viewing access levels control visibility
ACL action permissions are not the same as an item's viewing access level. An item's Access value points to a viewing access level whose selected groups may see that item. A user might be able to view an article but lack permission to edit it, or have an editing permission in a context where the item is not visible through the expected frontend path.
Troubleshoot from the user outward
- Identify the exact user and all groups the user belongs to.
- Identify the exact action that fails, such as
core.editorcore.create, rather than saying only that “permissions do not work.” - Identify the component/category/item where the action is being attempted.
- Inspect inherited and explicit rules from the higher levels down to the target.
- For visibility problems, separately inspect the item's viewing access level.
- Retest with the affected non-Super-User account.
Extensions must participate correctly
Joomla provides the ACL framework and authorization APIs, but extension code must check the appropriate permissions when implementing actions. If a third-party extension ignores or misapplies Joomla ACL, changing core Joomla group rules may not produce the expected behavior. Confirm the extension's documented permission model when core ACL results and extension behavior disagree.
Use least privilege and test both directions
Grant only the actions a role requires. Verify that the role can do what it should and, equally importantly, cannot do what it should not. Avoid using Super User membership as a workaround for a narrowly scoped permission problem.
Need More Help with Joomla?
Still having trouble? Open a support ticket with QuantaCade Support and we'll be happy to help where we can.
Support priority is given to QuantaCade products, services, and customers. However, we're also happy to assist fellow Joomla users with general Joomla questions and troubleshooting when possible.
QuantaCade is an independent Joomla extension developer and is not official Joomla support. Some issues involving third-party extensions, hosting environments, server configurations, or other systems outside our development control may be beyond what we're able to resolve.