commerce_product_variation_access
This module allows users to manage only the product variations they have created, providing fine-grained access control for store owners and marketplaces. It introduces permissions to restrict editing or deleting product variations to their respective owners, which is particularly useful for multi-vendor sites. The restrictions are enforced at the entity access level and apply to all roles, including administrators.
The Commerce Product Variation Access module gives store owners and marketplace operators fine-grained control over who can edit or delete product variations in Drupal Commerce. By default, Drupal Commerce only offers an all-or-nothing "manage variations" permission — meaning any user granted that permission can edit every variation on the site, regardless of who created it. This module solves that problem by introducing ownership-based access: users can only edit or delete the product variations they themselves created.
This is especially useful for multi-vendor stores, marketplaces, or any site where individual users manage their own product listings.
Features
Introduces two new permissions: Edit own product variations only and Delete own product variations only
Ownership is determined by the uid field on the variation itself — the user who created it
Ownership restrictions apply to all roles, including the Administrator role
Variations the current user cannot edit are shown with a grayed-out locked indicator in the variations list, making it immediately clear which variations are off-limits
Direct URL access to another user's variation edit form returns 403 Access Denied — the restriction is enforced at the entity access level, not just the UI
Works across all product variation bundle types (Physical, Digital, etc.)
No configuration interface needed — install and assign permissions
Post-Installation
After enabling the module:
Go to Admin → People → Permissions (/admin/people/permissions)
Find the Commerce Product Variation Access section
Grant Edit own product variations only and/or Delete own product variations only to the roles that should have ownership-restricted access (e.g. authenticated)
Optionally grant these permissions to the administrator role if you want ownership rules to apply to admins as well
No additional configuration pages are required. The module takes effect immediately after permissions are saved.
Additional Requirements
Drupal 11 or later
Drupal Commerce (drupal/commerce) 2.x — specifically the commerce_product submodule
Recommended modules/libraries
Commerce Shipping (drupal/commerce_shipping) — if your store uses physical product variations, this pairs naturally with ownership-based variation management
Profile (drupal/profile) — useful for multi-vendor setups where each vendor manages their own product catalog
Similar projects
Commerce Product Permissions — provides per-bundle product-level permissions but does not address ownership-scoped variation access
Entity Access Policies — a general-purpose entity access framework; more powerful but requires significant configuration to achieve the same result this module provides out of the box
Supporting this Module
If you find this module useful, please consider leaving a review on drupal.org or contributing bug reports and patches through the issue queue.
Community Documentation
Issue queue: https://www.drupal.org/project/commerce_product_variation_access/issues
Drupal Commerce documentation: https://docs.drupalcommerce.org