function custom_mod_action_info() {
  return array(
    'custom_mod_delete_user_cats' => array(
      'label' => t('Delete a users cats'),
      'type' => 'user',
      'configurable' => FALSE,
      'triggers' => array('any'),

This action is later used as VBO in a View.

I've defined an action like above in a custom module. How can I set some permissions so only users with a specific role can run this action?

  • I think the idea is that you secure permissions for the entities themselves, not the action. So if you have access to an entity, you can implicitly perform the action on it. I might be wrong though
    – Clive
    Commented Feb 9, 2016 at 10:19

1 Answer 1


For D7, I can see two answer depending on what behaviour you prefer:

  1. VBO has a sub-module action permissions. Enable this and it creates a permission for each action - see module page. If the user lacks permission then the action is not even available for them.

  2. If you need more granular permission that depends on the entity, then the "function which performs the action" can enforce it. For example see views_bulk_operations_user_roles_action. If the user lacks permission for some of the entities then the action won't take effect for those entities. However there is typically not really any feedback to tell the user.

For D8, there is ActionInterface::access, see docs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.