access_policy

Access policy is an incredibly powerful module that allows you to use fields and other attributes to control access to entities. No code required.

With Access Policy you can do things like:

1. Restrict content to members in a particular group, section or department.
2. Only allow authors to edit content from 9:00 AM - 5:00 PM, Monday through Friday.
3. Restrict content by priority or security level such as secret, confidential, public etc.
4. Make content private while granting view access to specific users (see screen shot).
5. Grant access to content by assigning it to individual users.
6. Soft-delete content with an “Add to trash” checkbox.
7. Grant access to users with a specific domain name in their email address.
8. Create gated content with a custom access denied message.
9. Allow authors to edit all unpublished content except for archived content.

Any many more use cases.

How it works:

Access policy compliments Drupal's role based access control (RBAC) architecture with an Attribute-Based Access Control (ABAC) architecture that leverages Drupal fields as the attributes.

In general it follows three steps:

1. Define the fields in Drupal.
2. Configure the access policy.
3. Assign the policy to entities.

For example, to restrict content by section:

1. Create a "Section" vocabulary.
2. Add a Section taxonomy term entity reference field to a content type and user.
3. Create a new Access policy that compares those fields.
4. Assign the Access policy to entities.

For more details, please see the Access Policy Overview or step-by-step Tutorials.

Developer notes

Built for developers:
This module is highly extensible with custom plugin types for Operations, Access Rules, Selection Rules and more. This gives developers complete control of how to define their access scheme. For more details please see the README and access_policy.api.php.

What is the difference with Drupal's new Access Policy API?
Starting with Drupal 10.3, Drupal core will be supporting its own Access Policy API.

There are two primary differences between the API and this module.

• The API is meant for developers and requires custom code. This module is configuration based and can be installed and configured without writing any code. Future versions of the Access Policy module will incorporate the new API when it is released.
• The API is a generic implementation of Policy Based Access Control (PBAC). This module is an implementation of Attribute-Based Access Control (ABAC). A type of PBAC that relies on Drupal fields to control access.

For more details you can watch this presentation about Attribute Based Access Control in Drupal.