I have following setup:

  • Taxonomy Departments (hierarchical in at least 3 levels)
    • Location A
      • Team A.1
        • Subteam A.1.I
        • Subteam A.1.II
        • Subteam A.1.III
      • Team A.2
    • Location B
      • Team B.1
      • Team B.2
  • Taxonomy "Worker" (taxo ref to "Department")
  • Content Type "performance review" (taxo ref to "Worker" and to "Department"), one user may have multiple of reviews (they can be done from time to time, like every 3 months)
  • Users with a specific role ("Manager")

What I need is:

  • Managers should only see specific departments and all workers in that department
  • If the manager can see Team A.1 (or Location A) he can see all (Teams and) Subteams also (and all workers belonging to those)
  • Managers should only see the performance reviews of workers he has access to

The question is:

  • How do I best go forward to get there?

Problems I found with existing modules and more problems:

  • You can give node acess based on taxonomy, but those modules don't give access to taxonomy based on taxonomy
  • To me it would be logic to give the user accounts a new field with reference to the "Department" and build the permissions from there. "Acces by Reference" for example would need me to give the "Department" a reference to users (which you could argue for, but in this project I would prefer the other way (or a synced both-way-solution).
  • Just in case you wonder about this: The review references the department (instead of always getting it from the referenced Worker taxo), because when workers switch to another department, the review should stay in the department in which it was created

If the only way forward is programming my own module:

1 Answer 1


I Think You need to take a look at Permissions By Term and you may need to get an extra step to implement some code to provide the required term and assign it for the required permission according to your required hierarchy.

  • Thanks. PBT for D7 did not work at all for me. For now I have a workaround with TAClite - it is a lot more hustle, because I have to give each manager the department permissions and access to every worker in that department also has to be set each time. That is far from ideal - I just do it that way for now to meet customer demands. So I am still open for more ideas and roads to success.
    – JohnnyThan
    Nov 14, 2017 at 3:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.