Delegate QCDR Rule and Token Management Without Granting Full Super User Access

You can delegate ordinary Rule and Token administration without making the operator a Joomla Super User. The delegated account needs access to the QCDR Administrator component plus the specific Rule/Token management actions you want it to perform.

Keep settings, entitlement, PHP Token authoring, Preview, and Discovery separate unless the same role genuinely needs those higher-impact capabilities.

Build the Minimum Joomla Permission Set

  1. Create or choose a Joomla user group for the QCDR operators.
  2. Grant that group QCDR core.manage so members can open the component.
  3. Grant Manage Rules, Manage Tokens, or both according to the job.
  4. Leave Manage Settings, Manage License, Manage PHP Tokens, Test Rules, and Run Discovery ungranted unless required.
  5. Test with a real member of that group rather than testing only as a Super User.

Know What Rule/Token Permissions Cover

Manage Rules protects Rule save, state, bulk actions, duplicate, delete, and ordering operations. Manage Tokens protects the equivalent Token operations. PHP-backed Tokens are an exception: the dedicated Manage PHP Tokens permission is also enforced for save, state changes, duplicate, and delete.

Live Processing Is a Settings Permission

Rule and Token Live Processing switches are saved through Manage Settings. A delegated Rule/Token editor without Manage Settings can prepare and organize content but cannot use that permission path to change the live-processing switches. Decide deliberately whether operators should have that site-wide runtime control.

Plan Locks Still Apply

Joomla ACL does not bypass QCDR tier enforcement. A delegated operator on Basic cannot legitimately save a Pro/Max-only configuration simply because Manage Rules or Manage Tokens is Allowed. Existing higher-tier configuration can remain preserved across a downgrade while unavailable features stay locked.

Normal Mutations Require a Valid Joomla Session

QCDR's state-changing Administrator forms use Joomla CSRF protection in addition to permission checks. A stale session can therefore produce a session-token failure even when the user's ACL is correct. Reload the Administrator page and retry before changing permissions unnecessarily.

Suggested Least-Privilege Test

  • Can the operator open QCDR Administrator?
  • Can the operator create/edit the intended Rules/Tokens?
  • Are Settings and entitlement changes unavailable unless intentionally granted?
  • Can the operator not manage PHP Tokens without the dedicated permission?
  • Do Pro/Max controls remain plan-gated?

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.