Joomla User ACL — Access Control Levels, Groups and Permissions

In this tutorial, you'll learn how Joomla Access Control Level (ACL) system works — user groups, access levels, permissions inheritance, and implementing granular access control for articles, categories, modules, and components.

What You'll Learn

• Joomla ACL overview — the most flexible permission system of any major CMS
• Default user groups: Public, Guest, Registered, Author, Editor, Publisher, Manager, Administrator, Super Users
• The permissions hierarchy and inheritance chain
• How to create custom user groups
• How to create and assign access levels
• The six permission types: Site Login, Admin Login, Super Admin, Access Component, Create, Delete, Edit, Edit State, Edit Own
• How effective permissions are calculated (deny > allow > inherited)
• Category-level permissions
• Article-level permissions
• Module access levels
• Component options permissions
• The asset hierarchy: root > component > category > article

Why It Matters

Joomla's ACL system gives you granular control over who can do what on your site. You can create a membership site where paying subscribers see exclusive content. You can let authors write articles without being able to publish them. You can give department managers control over their own section without accessing other parts of the site. This level of control is essential for any site with multiple user types.

Real-World Use

A corporate intranet runs on Joomla. The HR department publishes articles visible only to HR staff. Each department has its own section where only department members can create and edit content, but managers can publish. External consultants have limited access to specific project pages. The IT team has full administrator access. All this is managed through Joomla's ACL system without any additional extensions.

Learning Path

flowchart LR
  A["Essential Extensions"] --> B["User ACL
You are here"]:::current
  B --> C["User Management"]
  C --> D["Global Configuration"]
  D --> E["Security Hardening"]

  classDef current fill:#38bdf8,color:#0f172a,stroke-width:2px

ACL Overview

ACL stands for Access Control List. Joomla's ACL system has three main concepts:

These three concepts work together. You assign users to groups. You set permissions on groups. You use access levels to restrict viewing.

flowchart TD
  A["User"] --> B["User Groups"]
  B --> C["Permissions"]
  C --> D["What user can do"]
  B --> E["Access Levels"]
  E --> F["What user can see"]

Default User Groups

Joomla ships with these default groups:

Group Hierarchy

Groups inherit permissions from their parent groups. This is critical to understand:

Public
├── Guest
└── Registered
    ├── Author
    │   └── (Author inherits Registered permissions)
    ├── Editor
    │   └── (Editor inherits Registered permissions)
    └── Publisher
        └── (Publisher inherits Editor permissions, which inherit Registered)
            └── Manager
                └── (Manager inherits Publisher)
                    └── Administrator
                        └── (Administrator inherits Manager)
                            └── Super Users
                                └── (Super Users inherit Administrator)

If you give "Edit" permission to Registered, then Author, Editor, Publisher, Manager, Administrator, and Super Users all also have "Edit" permission through inheritance.

Creating Custom User Groups

To create a custom group:

1. Go to Users > Groups
2. Click "New"
3. Enter a group name (e.g., "Content Managers")
4. Select the parent group (e.g., Publisher — so they inherit Publisher permissions)
5. Save

# Create a custom user group
# Users > Groups > New
# Group Name: "Department Editors"
# Parent Group: "Editor"
# Save

# Create another group
# Group Name: "Department Publishers"
# Parent Group: "Publisher"
# Save

Your new group inherits all permissions from its parent. You then override specific permissions where needed.

Access Levels

Access levels control who can view items. Joomla ships with three default access levels:

Creating Custom Access Levels

To create a new access level:

1. Go to Users > Access Levels
2. Click "New"
3. Enter a title (e.g., "Department Members")
4. Select which user groups have access
5. Save

# Create a custom access level
# Users > Access Levels > New
# Title: "HR Department"
# Groups: Select "HR Staff" (a custom group you created)
# Save

Now you can set articles, categories, modules, and menu items to the "HR Department" access level. Only users in the "HR Staff" group can see them.

Permission Types

Joomla defines these permission actions:

Effective Permissions Calculation

Joomla calculates effective permissions using this logic:

DENY overrides ALLOW
ALLOW overrides INHERITED
INHERITED uses the parent setting

flowchart TD
  A["Check Permission"] --> B{"Set to DENY
for this group?"}
  B -->|Yes| C["DENY — cannot perform action"]
  B -->|No| D{"Set to ALLOW
for this group?"}
  D -->|Yes| E["ALLOW — can perform action"]
  D -->|No| F["INHERITED — use parent group setting"]
  F --> G{"Parent has ALLOW?"}
  G -->|Yes| E
  G -->|No| H{"Parent has DENY?"}
  H -->|Yes| C
  H -->|No| I["Continue up the hierarchy"]

This inheritance means you can set a broad permission at a high level (e.g., allow "Edit" for Registered) and then deny it for a specific subgroup.

Example: Deny Delete for Authors

# Scenario: Authors can create and edit their own articles,
# but should NOT be able to delete them.

# 1. Global Configuration > Permissions > Author
#    - Delete: Denied
# 2. This overrides the inherited setting from Registered
# 3. Authors can now create and edit but not delete

Category Permissions

Category-level permissions override component-level permissions for all articles in that category.

# Set category permissions
# Content > Categories > [Your Category]
# Click "Permissions" tab
# For "Department Editors" group:
#   - Edit: Allowed
#   - Edit State: Allowed
#   - Delete: Inherited (from component)
# Save

Now users in the "Department Editors" group can edit articles in this category and change their published state.

Use Case: Department Categories

# Create categories for each department
# Content > Categories
# - "HR Articles" → Permissions: HR Staff can Edit, Delete
# - "Engineering Articles" → Permissions: Engineering can Create, Edit
# - "Sales Articles" → Permissions: Sales can Create, Edit, Edit State

Each department manages its own section without interfering with others.

Article Permissions

You can set permissions on individual articles. This is useful for specific cases:

# Set article-level permissions
# Content > Articles > [Your Article]
# Click "Permissions" tab
# For "Management" group:
#   - Edit: Allowed
# Save

Article permissions override category permissions, which override component permissions.

Module Access Levels

Modules have an Access Level field. Set it to control who sees the module:

# Restrict a module to logged-in users
# Extensions > Modules > [Your Module]
# Find "Access" field
# Select "Registered"
# Save

Now only logged-in users see that module. This is useful for:

• Member-only navigation menus
• User account information panels
• Private announcements

Component Options Permissions

Every component has its own permission settings in its Options:

# Set component-level permissions
# Components > [Component Name] > Options
# Click "Permissions" tab
# Configure per user group
# Save

For example, in com_content Options:

• Set "Create" to Allowed for Author
• Set "Edit State" to Allowed for Publisher
• Set "Delete" to Denied for Author

Asset Hierarchy

Joomla stores permissions in an asset hierarchy:

Root (1)
├── com_content (component)
│   ├── category.2 (category ID 2)
│   │   ├── article.1 (article ID 1)
│   │   └── article.2 (article ID 2)
│   └── category.3 (category ID 3)
├── com_contact (component)
└── com_banners (component)

Permissions cascade down the hierarchy. Setting a permission on com_content affects all articles in all categories. Setting it on a specific category affects only articles in that category.

Planning Your ACL Strategy

Before creating groups and permissions, plan your strategy:

1. List user roles: Write down every type of user your site needs
2. Define permissions per role: What can each role create, edit, delete, publish?
3. Group similar roles: Combine into parent-child group hierarchies
4. Create access levels: Determine who can see what content
5. Test thoroughly: Create test users in each group and verify permissions

# Example ACL plan for a membership site

# Groups:
# - Free Member (parent: Registered)
#   - Reads public articles, sees basic content
# - Premium Member (parent: Free Member)
#   - Reads premium articles, downloads files
# - VIP Member (parent: Premium Member)
#   - Creates forum posts, submits articles
# - Moderator (parent: VIP Member)
#   - Edits all articles, manages forum

# Access Levels:
# - Public (Public group)
# - Free (Free Member group)
# - Premium (Premium Member group)
# - VIP (VIP Member, Moderator groups)
# - Staff (Moderator, Administrator groups)

Common Mistakes

1. Setting everything to Allowed: Beginners set every permission to Allowed because they think it is safe. This gives users more access than they need. Only set actions to Allowed if a user group specifically needs them.

2. Ignoring the deny > allow rule: You deny "Delete" at the component level for Registered, but allow "Delete" at a category level for a subgroup. The DENY at component level still wins because deny overrides allow everywhere.

3. Not testing with a real user account: You set up permissions while logged in as Super User. Everything works because Super Users bypass all restrictions. Log out and test with a real user account in the target group.

4. Creating too many groups: You create 25 custom groups with slight variations. Managing permissions becomes impossible. Keep your group structure flat and simple — 5 to 8 groups is usually enough.

5. Forgetting module access levels: You restrict articles with access levels, but a module on the same page shows content from those restricted articles. Always set module access levels to match your content access levels.

Practice Questions

1. What is the order of priority when Joomla calculates effective permissions? Answer: The priority is: Deny overrides everything, then Allow overrides Inherited. If neither Deny nor Allow is set, Joomla inherits from the parent group up the hierarchy. The most specific level (article > category > component > global) wins within the same group.

2. How do you create a custom access level for a group of editors? Answer: Create a custom user group (e.g., "Senior Editors") under Users > Groups. Then create an access level under Users > Access Levels. Name it "Senior Content", select the "Senior Editors" group. Apply this access level to articles, categories, or modules that only Senior Editors should see.

3. What does the "Edit Own" permission do differently from "Edit"? Answer: "Edit Own" allows a user to edit only items they created themselves. "Edit" allows a user to edit any item regardless of who created it. For an author group, set Edit to Inherited (or Denied) and Edit Own to Allowed so authors can modify their own work but not others' articles.

4. Challenge: Design and implement an ACL system for a multi-department intranet. Create groups: "HR Staff", "Engineering Staff", "Sales Staff", "Department Managers", and "IT Admin". Create categories for each department with permissions that let department staff create and edit their own articles. Allow Department Managers to edit all articles in their department and change states. Allow IT Admin to access everything. Create an "Executive" access level visible only to Department Managers and IT Admin. Test every permission with actual user accounts.

FAQ

Mini Project

Your task: Build a complete access control system for a membership site.

1. Plan the user roles: Free Member, Premium Member, Content Editor, Moderator, Admin.
2. Create the user groups with appropriate parent inheritance.
3. Create access levels: Free, Premium, Staff, Admin.
4. Create categories for "Free Content", "Premium Content", "Staff Only".
5. Set category permissions so Premium Members can view Premium Content and Free Members cannot.
6. Create articles in each category with appropriate access levels.
7. Create a module (e.g., "Premium Downloads") with the Premium access level.
8. Create menu items for each content type with appropriate access levels.
9. Create test users in each group.
10. Log in as each test user and verify they see exactly the content they should.

This project mirrors a real membership site ACL setup — a common requirement for Joomla developers.

What's Next

Now that you understand ACL, you are ready to manage users in practice:

Continue to Lesson 26: User Management — Learn how to manage user registration, profiles, bulk operations, and the user database.

Related lessons:

• Joomla Global Configuration — Set default user permissions site-wide
• Joomla Security Hardening — Protect user accounts with security best practices