How Joomla ACL Permissions Work

Users receive permissions through groups

Users belong to one or more user groups, and groups can have parent-child relationships. Build permissions around roles represented by groups rather than configuring special privileges for individual users. Effective access can come from several memberships at once.

Joomla evaluates actions in an asset hierarchy

Components define actions such as create, edit, delete, edit state, or configuration access. Depending on the component, permissions can be configured globally and then at component, category, or individual-item levels.

Understand Inherited, Allowed, and Denied

An Allowed rule grants an action when no applicable Denied rule prevents it. An explicit Denied is restrictive and cannot simply be overridden by adding Allowed lower in the applicable hierarchy. An inherited or unset value means Joomla must continue evaluating relevant parent and group rules.

Use the calculated permission result

After changing permissions, save and inspect Joomla's calculated or effective setting. If the result remains Denied, look upward in the asset hierarchy and across the user's other groups for the rule causing it.

Keep viewing access separate from action permissions

An item's Access value points to a viewing access level and controls visibility. It does not itself grant editing or administrative actions.

Troubleshoot ACL methodically

1. Identify the exact user and every group the user belongs to.
2. Identify the exact failed action.
3. Identify the component, category, or item where the action is attempted.
4. Inspect applicable rules from higher levels down to the target.
5. Check Joomla's calculated permission result.
6. For visibility problems, separately inspect the viewing access level.
7. Retest with the affected non-Super-User account.

Account for extension-specific behavior

Joomla provides the ACL framework, but extensions must check the appropriate permissions when implementing actions. Review an extension's documented permission model when its behavior disagrees with Joomla's calculated core permissions.

Use least privilege and test both directions

Grant only the actions a role requires. Verify that the role can do what it should and cannot do what it should not. Avoid Super User membership as a workaround for a narrowly scoped permission problem.