Separate QCDR Settings, License, and Content-Management Permissions

QCDR 1.1.05 separates configuration, entitlement, Rules, and Tokens into different Joomla permissions so day-to-day content operators do not need authority over installation-wide settings or licensing.

Start delegation with core.manage for Administrator component access, then grant only the QCDR actions the role actually needs.

The Permission Boundaries

  • Manage Settings: changes installation-wide QCDR settings, including Runtime Safety and the Rule/Token Live Processing switches.
  • Manage License: refreshes entitlement, starts an eligible one-time 30-Day Max Preview, and clears legacy saved-key state.
  • Manage Rules: creates, edits, orders, changes state, duplicates, and deletes Rules.
  • Manage Tokens: performs the equivalent normal Token-management work.
  • Manage PHP Tokens: adds the separate high-risk permission required to author or manage PHP-backed Tokens.

Plan entitlement remains a separate gate. Giving somebody a Joomla permission does not unlock a Pro- or Max-only capability that the current Effective tier does not include.

A Practical Least-Privilege Split

For a content operator who only maintains replacements, grant core.manage plus Manage Rules and/or Manage Tokens. Leave Manage Settings and Manage License ungranted unless the same person is responsible for site-wide processing controls or subscription/domain administration.

If the role needs Discovery, add Run Discovery separately. PHP Token authoring should be reserved for administrators trusted to deploy server-side code.

Keep Entitlement Maintenance Separate

Manage License allows normal entitlement actions, but repairing the canonical Entitlement Revalidation task is intentionally stricter. The Repair Entitlement Task action requires Joomla core.admin/Super User authority.

That means a delegated licensing operator can refresh entitlement without automatically receiving permission to rewrite Joomla Scheduled Task structure.

Test Delegation with a Real Account

  1. Create or choose the Joomla group that will receive the QCDR role.
  2. Grant QCDR core.manage.
  3. Grant only the specialized QCDR actions required for the job.
  4. Sign in as a member of that group and verify allowed actions.
  5. Also verify that Settings, License, PHP, Preview, or Discovery actions that should remain restricted are actually denied.

Do not use a Super User session to validate least-privilege behavior: QCDR's normal custom-permission helper treats core.admin as an override.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDR feature? Visit the QC Dynamic Replacer Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.