What is the best way to create a component which will be authored/edited by only one user group?

To ensure only admins or a specific user group (e.g., content-authors-admin) can edit a specific AEM component:

Steps:

1. Create User Group

   • Use /useradmin to create a group (e.g., content-authors-admin) and add users.

2. Set ACL Permissions

   • In /crx/de, navigate to the component path (/apps/yourproject/components/restricted).

   • Deny write access (jcr:write, rep:write) for everyone.

   • Allow write access for content-authors-admin.

3. Optional: Hide from Authoring UI

   • Use cq:editConfig to limit editing actions.

   • Adjust allowedComponents in template policy to hide the component from unauthorized authors.

4. Verify Access

   • Test with normal authors (read-only) and admin users (edit access).

Result:

Only specified users/groups can edit the component; others can view but not modify it.

Hope this helps.

Hi,

You can try like this 

1. Go to CRX/DE Lite (/crx/de)

2. Navigate to your component path:
   /apps/projectname/components/sample

3. Set permissions:

   • Deny replicate, modify, and write access to general author groups (like content-authors)

   • Allow full access (read, modify, write) to admin-authors

Use the User Admin Console (/useradmin) or CRX Access Control Editor to do this

Hi @donquixote_dofl ,

Try with below solution:

1. Create the User Group

Go to /useradmin:

  - Create a group: admin-authors

  - Add users who should be able to edit the component

2. Set Component Permissions

Navigate in /crx/de to the component:

Deny Access to Regular Authors:

  - Right-click the component → Access Control

  - Select group content-authors

        - Deny:

              - jcr:write

              - rep:write

              - jcr:modifyProperties

Allow Access to Admin Authors:

  - Add admin-authors group

           - Allow:

                 - jcr:read

                 - jcr:write

                - jcr:modifyProperties

                - jcr:nodeTypeManagement (optional, for dialog editing)

Note: In AEM, deny wins over allow. So if a user is in multiple groups (one denied, one allowed), they still get denied.

Regards,
Amit

Hi @donquixote_dofl ,

One approach can be as follows:-

1. create a node cq:EditConfig with insert/copy with allowed default property

2.Add below sly tag to call the sling model

<sly data-sly-use.disableEdit="com.projectname.core.models.EditToolbarModel"></sly>

2.Create a sling model to allow if user is part of certain allowed groups

@Model(adaptables = {
        SlingHttpServletRequest.class,
        Resource.class}, defaultInjectionStrategy = DefaultInjectionStrategy.OPTIONAL)
public class EditToolbarModel {
    Logger logger = LoggerFactory.getLogger(this.getClass());
    @SlingObject
    private SlingHttpServletRequest request;

    
    @PostConstruct
    protected void init() {
        if (WCMMode.fromRequest(request).equals(WCMMode.EDIT) && isUserAllowed(request)) {
            ComponentContext componentContext = WCMUtils.getComponentContext(request);
            if (componentContext != null) {
                Toolbar toolbar = componentContext.getEditContext().getEditConfig().getToolbar();
                toolbar.add(EditAction.EDIT);
                toolbar.add(EditAction.DELETE);
            }
        }
    }


    private boolean isUserAllowed(SlingHttpServletRequest request) {
        List<String> groupList= new ArrayList<>(Arrays.asList("super-author", "group2","otherGroupToBeAllowed"));
        try {
            User currentUser = request.getResourceResolver().adaptTo(User.class);
            if (currentUser != null) {
                Iterator<Group> currentUserGroups = currentUser.memberOf();
                while (currentUserGroups.hasNext()) {
                    Group group = currentUserGroups.next();
                    if (groupList.contains(group.getID())) {
                        return true;
                    }
                }
            }
        } catch (RepositoryException e) {
            throw new DataException(e);
        }
        return false;
    }

}

PS:- User will still be able to edit from crxde if has access to crx and part of content author

Thanks

Hi @donquixote_dofl 

Please check https://medium.com/@arunpatidar26/aem-restrict-component-dialog-editing-028534f194e1