I have two content type one called audit and one called non-conformance, a non conformance is raised after an audit has been complete.

An audit contains an entity reference field called auditee which references a user, I would like to give edit access to the non conformance based on the the content of the auditee field in on the content type audit.


2 Answers 2


This should do the trick for you. You only have to write the code for extract_uid_from_audit(); if you don't know how we can help as well.

function mymodule_node_access($node, $op, $account) {
    if(!empty($node->type) && ($node->type == "non_conformance")
             && $op=='update') ){
        $uid = extract_uid_from_audit($node);
        if($uid = $account->uid)
             return NODE_ACCESS_ALLOW;
  • So this has to be done with a custom module? It can't be done just using rules? Commented Feb 19, 2013 at 18:32
  • This is a non-standard access setting. You either have to find a module that will allow you to set this up or you program it yourself.
    – Pawel G
    Commented Feb 20, 2013 at 9:05
  • Using modules maybe you can fix it with Organic Groups. Audit being a group, non-conformance - group content, auditee - a role within a group. That way you could give specific access rights per group, per role. Yes this is a lot of work but it should work better than node_access() hacks.
    – Pawel G
    Commented Feb 20, 2013 at 9:13

You can do this with a couple of modules + a view that uses an entity reference display.

If you add the "Node access user reference" module, you can create a view that lists users of a specific role (I guess they would have a role like auditees?). Details from project page:

Gives content access permissions to users for content that references the users with User reference or Entity reference.

This is great if you want your content authors to be able to choose additional authors, or choose who can view their content, as well as being able to display the list of authors or viewers within your content, or in views displays.

When you configure the auditee entity reference field, you can use that view to populate the field and you can set the field so that those auditee users have varying degrees of access. It's also a good idea to allow the original authors of the to continue having permissions of view, edit, delete.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.