For granular node access, TAC, TAC lite, Content Access or ACL can be used, but because of some technical limitations and issues, I can not use them.

While implementing the node access part of my module, I've realized there are 2 type of hooks, total of 3. I've watched hours of videos, read many articles and I am still confused which one does what:

For granular access control over each node with an specific nid, I can implement hook_node_access and see if the user has permission to view/update/delete the requested node.
I will also disable any other kind of node access system (roles permissions to access nodes, TAC, ACL,...) so only my module decides who has access to what.

This should work fine but the question is: what is node_access table used for? ACL and other fellas use it. But what is it? does it direcrly concern me too?

  • I need to give this a more careful read, but I think you may need to split this up into different questions.
    – mpdonadio
    May 4, 2013 at 16:39
  • This is for Drupal 6, correct?
    – Aiias
    May 4, 2013 at 17:11
  • @Aiias Totally 7! :D
    – hkoosha
    May 5, 2013 at 7:54
  • @Aiias Drupal 6 also has hook_node_access_records() and hook_node_grants() however it doesn't have hook_node_access(). The closest thing it has to that is hook_access(). With hook_access() though you cannot affect content types created by other modules.
    – rooby
    Jun 27, 2016 at 0:31

2 Answers 2


hook_node_access() is a standalone hook and has nothing to do with the node_access table.

hook_node_access_records() and hook_node_grants() go together and are different to hook_node_access(). These hooks use the node_access table.

Basically, the node_access table stores all the access grants for nodes. These grants can then be queried and joined to other queries to check the access rules for a node.

hook_node_access_records() is invoked when writing access rules to the node_access table and hook_node_grants() is invoked when reading them out again.

To give you a better idea of how the hooks work, look at the code where they get invoked from.

For hook_node_access_records() this is node_access_acquire_grants(). It invokes the hook and then writes all the returned grants to the node_access table.

hook_node_grants() is called from a few places, but generally via the node_access_grants() function, which is called from a few places. Take a look at the node_access() function as an example.

It queries the node_access table, adding to the query conditions any access grants returned by modules that implement hook_node_access_grants(). Note that grants are also alterable via hook_node_grants_alter().

While you are looking at the node_access() function you can also see how hook_node_access() is called and you'll see how it is different and why it's not as flexible a solution to access control.

In case you haven't seen it, this is a good article on the topic: http://www.phase2technology.com/blog/drupal-7-node-access-grants-locks-and-keys/


nid - node id
gid - userid if realm is "workflow_access_owner". role_id if realm is workflow_access
realm - enum (all, workflow_access_owner, workflow_access)
grant_view - has view privileges?
grant_update - has update privileges?
grant_delete - has delete privileges?

  • How does this answer the question like "What is node_access table used for?"? Mar 20, 2017 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.