Fine-grained access control

Most communities are well served by the built-in groups. When you need something more precise, your forum includes Gatekeeper: a rule-based access-control system you manage entirely from the admin interface — no code, no redeploys.

The three concepts

• Permission — an atomic action, like editpost or deletetopic. Permissions come in three kinds: built-in (shipped with the forum), plugin (added by a plugin), and user-defined (ones you create).
• Rule — a logical combination of conditions, using AND, OR, and grouping. The condition types are hasany, hasall, and resource_requirement (a resource-scoped check). Example: is an Administrator OR (is a Moderator AND has deletepost).
• Edict — the link between a rule and a protected resource (an action or screen in the forum, identified by a resource key such as view_admin_dashboard). When someone tries to use that resource, Gatekeeper evaluates the edict’s rule to decide whether to allow it.

In short: permissions are the vocabulary, rules are the sentences, and edicts apply a sentence to a place in the app.

Create a permission

1. Management area → Permissions → Add.
2. Enter a descriptive, unique key (e.g. custom_action).
3. Save. It’s now available when you build rules.

Build a rule

1. Management area → Rules → Add.
2. Give the rule a clear name (e.g. admin_or_mod_with_delete).
3. Use the visual rule builder:
   • Toggle the group operator between AND and OR.
   • Add conditions — choose a type (hasany, hasall, or resource_requirement) and pick the permission or role it checks.
   • Use Add group to nest conditions for complex logic.
4. Submit the rule.

Example: admin, or a moderator who can delete

1. Set the top-level operator to OR.
2. Add a condition: hasany → Administrator role.
3. Add group, set it to AND.
4. In the group add hasany → Moderator role, and hasany → deletepost permission.
5. Submit. Access is granted to administrators, or to moderators who also have deletepost.

Protect a resource with an edict

1. Management area → Edicts → Add.
2. Enter the resource key for the thing you want to protect. It must match the identifier used in the application (the available resource keys are listed in the edicts interface).
3. Save, then open Edicts, edit your new edict, and attach the rule you built.

From now on, access to that resource is governed by your rule.

Troubleshooting

• Rule isn’t taking effect — check that the permissions and roles it names actually exist and are assigned to the members you expect.
• Edict seems ignored — confirm the resource key exactly matches the one used by the application.

Note

Gatekeeper is powerful; test rule changes with a non-admin account before relying on them, since a wrong rule can lock people out of (or into) a resource.